Ubuntu: 4697-1 Critical: Pillow Denial of Service and Code Risks

ubuntu

January 18, 2021

Pillow could be made to crash or run programs as your login if it opened a specially crafted file.

Summary

Pillow could be made to crash or run programs as your login if it opened a

specially crafted file.

Software Description:

- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain PCX image files.

If a user or automated system were tricked into opening a specially-crafted

PCX file, a remote attacker could possibly cause Pillow to crash,

resulting in a denial of service. (CVE-2020-35653)

It was discovered that Pillow incorrectly handled certain Tiff image files.

If a user or automated system were tricked into opening a specially-crafted

Tiff file, a remote attacker could cause Pillow to crash, resulting in a

denial of service, or possibly execute arbitrary code. This issue only

affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain SGI image files.

If a user or automated system were tricked into opening a specially-crafted

SGI file, a remote attacker co...

Read the Full Advisory

Topics Covered

security advisory denial of service critical software update code execution Ubuntu ubuntu image processing Pillow

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  python3-pil                     7.2.0-1ubuntu0.1

Ubuntu 20.04 LTS:
  python3-pil                     7.0.0-4ubuntu0.2

Ubuntu 18.04 LTS:
  python-pil                      5.1.0-1ubuntu0.4
  python3-pil                     5.1.0-1ubuntu0.4

Ubuntu 16.04 LTS:
  python-pil                      3.1.2-0ubuntu1.5
  python3-pil                     3.1.2-0ubuntu1.5

In general, a standard system update will make all the necessary changes.