Ubuntu: 4763-1 Critical: Pillow Denial Of Service Threat

ubuntu

March 11, 2021

Several security issues were fixed in Pillow.

Summary

Several security issues were fixed in Pillow.

Software Description:

- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain Tiff image files.

If a user or automated system were tricked into opening a specially-crafted

Tiff file, a remote attacker could cause Pillow to crash, resulting in a

denial of service, or possibly execute arbitrary code. This issue only

affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2021-25289,

CVE-2021-25291)

It was discovered that Pillow incorrectly handled certain Tiff image files.

If a user or automated system were tricked into opening a specially-crafted

Tiff file, a remote attacker could cause Pillow to crash, resulting in a

denial of service, or possibly execute arbitrary code. (CVE-2021-25290)

It was discovered that Pillow incorrectly handled certain PDF files. If a

user or automated system were tricked into opening a specially-crafted

PDF file, a remote attacker could cause Pill...

Read the Full Advisory

Topics Covered

security advisory denial of service security update critical software issue ubuntu pillow

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.10:
  python3-pil                     7.2.0-1ubuntu0.2

Ubuntu 20.04 LTS:
  python3-pil                     7.0.0-4ubuntu0.3

Ubuntu 18.04 LTS:
  python-pil                      5.1.0-1ubuntu0.5
  python3-pil                     5.1.0-1ubuntu0.5

Ubuntu 16.04 LTS:
  python-pil                      3.1.2-0ubuntu1.6
  python3-pil                     3.1.2-0ubuntu1.6

In general, a standard system update will make all the necessary changes.