CVE-2020-35654

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

This update for python-CairoSVG, python-Pillow fixes the following issues:

Update to version 2.5.1.

• Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time.
• Fix marker positions for unclosed paths
• Follow hint when only output_width or output_height is set
• Handle opacity on raster images
• Don’t crash when use tags reference unknown tags
• Take care of the next letter when A/a is replaced by l
• Fix misalignment in node.vertices

Updates for version 2.5.0.

• Drop support of Python 3.5, add support of Python 3.9.
• Add EPS export
• Add background-color, negate-colors, and invert-images options
• Improve support for font weights
• Fix opacity of patterns and gradients
• Support auto-start-reverse value for orient
• Draw images contained in defs
• Add Exif transposition support
• Handle dominant-baseline
• Support transform-origin

python-Pillow update to version 8.3.1:

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

• Moved CVE image to pillow-depends #5561 [radarhere]

• Added tag data for IFD groups #5554 [radarhere]

• Improved ImagePalette #5552 [radarhere]

• Add DDS saving #5402 [radarhere]

• Improved getxmp() #5455 [radarhere]

• Convert to float for comparison with float in IFDRational eq #5412 [radarhere]

• Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

• Read FITS image mode and size #5405 [radarhere]

• Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

• Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

• Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

• Copy palette to new images in ImageOps expand #5551 [radarhere]

• Ensure palette string matches RGB mode #5549 [radarhere]

• Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

• Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

• Added DDS BC5 reading #5501 [radarhere]

• Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

• Added ICO saving in BMP format #5513 [radarhere]

• Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

• Do not allow TIFF to seek to a past frame #5473 [radarhere]

• Avoid race condition when displaying images with eog #5507 [mconst]

• Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

• Allow converting an image to a numpy array to raise errors #5379 [radarhere]

• Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

• Remove spikes when drawing thin pieslices #5460 [xtsm]

• Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

• Removed TIFF DPI rounding #5446 [radarhere, hugovk]

• Include code in WebP error #5471 [radarhere]

• Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

• Reset handle when seeking backwards in TIFF #5443 [radarhere]

• Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

• Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

• Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

• Do not round dimensions…

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.

Root has patched CVE-2020-35654 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
• Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
• Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
• Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
• Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
• Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
• Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
• Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
• OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

This update for python-Pillow fixes the following issues:

• Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
• Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
• Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
• Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
• Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
• Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
• Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
• Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
• OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-2020-35653)

It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain SGI image files. If a user or automated system were tricked into opening a specially-crafted SGI file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-35655)