pillow: CVE-2019-19911 CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Debian Bug report logs - #948224
pillow: CVE-2019-19911 CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Markus Koschany <apo@debian.org>

To: submit@bugs.debian.org

Subject: pillow: CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Date: Sun, 5 Jan 2020 16:30:36 +0100

[Message part 1 (text/plain, inline)]

Package: pillow
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerabilities were published for pillow. It appears they
are fixed in version 6.2.2.

CVE-2020-5310[0]:
| libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding
| integer overflow, related to realloc.


CVE-2020-5311[1]:
| libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer
| overflow.


CVE-2020-5312[2]:
| libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer
| overflow.


CVE-2020-5313[3]:
| libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer
| overflow.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-5310
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5310
[1] https://security-tracker.debian.org/tracker/CVE-2020-5311
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5311
[2] https://security-tracker.debian.org/tracker/CVE-2020-5312
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312
[3] https://security-tracker.debian.org/tracker/CVE-2020-5313
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313

Please adjust the affected versions in the BTS as needed.

Regards,

Markus

[signature.asc (application/pgp-signature, attachment)]

Message #10 received at 948224@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: 948224@bugs.debian.org

Subject: Re: Bug#948224: pillow: CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Date: Sun, 5 Jan 2020 17:51:00 +0100

Control: found -1 6.2.1-2
Control: retitle pillow: CVE-2019-19911 CVE-2020-5310 CVE-2020-5311 CVE-2020-5312 CVE-2020-5313

Hi,

On Sun, Jan 05, 2020 at 04:30:36PM +0100, Markus Koschany wrote:
> The following vulnerabilities were published for pillow. It appears they
> are fixed in version 6.2.2.

Additionally there is CVE-2019-19911, fixed by
https://github.com/python-pillow/Pillow/commit/774e53bb132461d8d5ebefec1162e29ec0ebc63d
as well adressed in 6.2.2. Thus track it here with same bug.

Regards,
Salvatore

Message #23 received at 948224-submitter@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: control@bugs.debian.org

Cc: 948224-submitter@bugs.debian.org

Subject: closing 948224

Date: Mon, 06 Jan 2020 16:37:39 +0100

# fixed in 7.0.0 but bug was not closed
close 948224 7.0.0-1
thanks

Send a report that this bug log contains spam.