Ubuntu 21.10: USN-5227-1 Moderate: Pillow Denial Of Service

ubuntu

January 13, 2022

Several security issues were fixed in Pillow.

Summary

Several security issues were fixed in Pillow.

Software Description:

- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain image files. If a

user or automated system were tricked into opening a specially-crafted

file, a remote attacker could cause Pillow to hang, resulting in a denial

of service. (CVE-2021-23437)

It was discovered that Pillow incorrectly handled certain image files. If a

user or automated system were tricked into opening a specially-crafted

file, a remote attacker could cause Pillow to crash, resulting in a denial

of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and

Ubuntu 21.04. (CVE-2021-34552)

It was discovered that Pillow incorrectly handled certain image files. If a

user or automated system were tricked into opening a specially-crafted

file, a remote attacker could cause Pillow to crash, resulting in a denial

of service, or possibly execute arbitrary code. (CVE-2022-...

Read the Full Advisory

Topics Covered

security advisory denial of service software update ubuntu image handling pillow

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  python3-pil                     8.1.2+dfsg-0.3ubuntu0.1

Ubuntu 21.04:
  python3-pil                     8.1.2-1ubuntu0.2

Ubuntu 20.04 LTS:
  python3-pil                     7.0.0-4ubuntu0.5

Ubuntu 18.04 LTS:
  python-pil                      5.1.0-1ubuntu0.7
  python3-pil                     5.1.0-1ubuntu0.7

In general, a standard system update will make all the necessary changes.