CVE-2020-5313

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: out-of-bounds reads/writes in the parsing of SGI image files in expandrow/expandrow2 (CVE-2020-11538)

• python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images (CVE-2020-5313)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

Updated python-pillow packages fix security vulnerabilities:

It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service (CVE-2019-16865, CVE-2019-19911).

It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this issue to cause a crash (CVE-2020-5310).

It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this issue to execute arbitrary code or cause a crash (CVE-2020-5311).

It was discovered that Pillow incorrectly handled certain PCX images. An attacker could possibly use this issue to execute arbitrary code or cause a crash (CVE-2020-5312).

It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this issue to execute arbitrary code or cause a crash (CVE-2020-5313).

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

This update for ansible, crowbar-core, crowbar-ha, crowbar-openstack, etcd, flannel, grafana, keepalived, kibana, memcached, monasca-installer, openstack-dashboard-theme-SUSE, openstack-manila, openstack-neutron-fwaas, openstack-nova, openstack-tempest, python-Django, python-Pillow, python-psql2mysql, python-psutil, python-py, python-pysaml2, python-waitress, rabbitmq-server, release-notes-suse-openstack-cloud, zookeeper fixes the following issues:

Security fixes included ins this update:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

memcached (to version 1.5.17)

• CVE-2019-15026: Fixed a stack-based buffer over-read in conn_to_str()n (bsc#1149110).
• CVE-2019-11596: Fixed a denial of service in the 'lru' command (bsc#1133817)
• CVE-2018-1000115: Disabled UDP by default to reduce DDoS amplification attacks (bsc#1083903).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• Fixed a regression with the fix for CVE-2019-3498 (bsc#1161349).

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse(bsc#1068612).

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue through specially crafted requests (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed Unsafe Object Creation Vulnerability in JSON (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed HTTP Request Smuggling through proxy (bsc#1172175)
• CVE-2020-11076: Fixed HTTP Request smuggling through invalid Transfer-Encoding header.
• CVE-2020-5247: Fixed HTTP Response Splitting through newline characters handling (bsc#1165402)

zookeeper:

• CVE-2019-0201: Fixed an information disclosure related to getACL() (bsc#1135773).

Non security fixes included in this update:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in crowbar-core:

• Update to version 4.0+git.1580209654.1d112d31f:
  • network: start OVS before wickedd (SOC-11067)

Changes in crowbar-ha:

• Update to version 4.0+git.1585316203.d6ad2c8:
  • [4.0] add ssl termination on haproxy (bsc#1149535)

Changes in crowbar-openstack:

• Update to version 4.0+git.1589804581.9972163f0:

  • [4.0] magnum: fix check for image/flavor (SOC-11251)

• Update to version 4.0+git.1589647351.ccfd9481f:

  • [4.0] trove: fix rabbitmq connection URL (SOC-11286)

• Update to version 4.0+git.1589458214.9f765aa08:

  • [4.0] Fix create magnum k8s image and flavor (SOC-11251)

• Update to version 4.0+git.1588271860.131fc8cc1:

  • run keystone_register on cluster founder only when HA (SOC-11248)
  • nova: run…

This update for ansible1, ardana-ansible, ardana-cobbler, ardana-glance, ardana-input-model, ardana-logging, ardana-manila, ardana-monasca, ardana-mq, ardana-neutron, ardana-octavia, ardana-tempest, crowbar-core, crowbar-openstack, grafana, kibana, openstack-barbican, openstack-ceilometer, openstack-cinder, openstack-dashboard, openstack-designate, openstack-heat-templates, openstack-ironic, openstack-keystone, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-neutron, openstack-neutron-vsphere, openstack-nova, openstack-octavia, openstack-octavia-amphora-image, openstack-resource-agents, python-Django1, python-Pillow, python-ardana-packager, python-heatclient, python-neutron-tempest-plugin, python-octavia-tempest-plugin, python-os-brick, python-oslo.messaging, python-pyroute2, python-urllib3, python-waitress, release-notes-suse-openstack-cloud, rubygem-activeresource, rubygem-json-1_7, rubygem-puma fixes the following issues:

Security fixes included in this update:

ansible1:

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana:

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana:

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

python-Django1 to 1.11.29:

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys (bsc#1172167).
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget (bsc#1172166).
• CVE-2020-7471: Fixed a SQL injection via StringAgg delimiter (bsc#1161919).
• CVE-2020-9402: Fixed a SQL injection via tolerance parameter in GIS functions and aggregates (bsc#1165022).
• CVE-2019-19844: Fixed a potential account hijack via password reset form (bsc#1159447).

python-Pillow:

• CVE-2020-10177: Fixed multiple out-of-bounds reads in libImaging/FliDecode.c (bsc#1173413).
• CVE-2020-11538: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173420).
• CVE-2020-10994: Fixed multiple out-of-bounds reads via a crafted JP2 files (bsc#1173418).
• CVE-2020-10378: Fixed an out-of-bounds read when reading PCX files (bsc#1173416).
• CVE-2019-16865: Fixed a denial of service with specially crafted image files (bsc#1153191).
• CVE-2020-5311: Fixed an SGI buffer overflow (bsc#1160151).
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode (bsc#1160152).
• CVE-2020-5313: Fixed a buffer overflow related to FLI (bsc#1160153).
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py (bsc#1160192).

python-waitress to version 1.4.3:

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling (bsc#1161088).
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding (bsc#1161089).
• CVE-2019-16789: Fixed HTTP Request Smuggling through invalid whitespace characters (bsc#1160790).
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling (bsc#1161670).

rubygem-activeresource:

• CVE-2020-8151: Fixed possible information disclosure through specially crafted requests (bsc#1171560).

Non security fixes:

Changes in ansible1.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ardana-ansible.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Update to version 9.0+git.1591138508.e269bdb:

  • Use internal endpoint for upload image (SOC-11294)

• Update to version 9.0+git.1589740968.d339a28:

  • Reconfigure rabbitmq user permissions on update (SOC-11082)

• Update to version 9.0+git.1588953276.b8b5512:

  • Fix incorrect prefix used to collect supportconfig files (bsc#1171273)

Changes in ardana-cobbler.SUSE_SLE-12-SP4_Update_Products_Cloud9_Update:

• Update to version 9.0+git.1588181228.bae3b1f:
  • Ensure…

This update for ansible, ansible1, ardana-ansible, ardana-cluster, ardana-freezer, ardana-input-model, ardana-logging, ardana-mq, ardana-neutron, ardana-octavia, ardana-osconfig, caasp-openstack-heat-templates, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-dashboard, openstack-dashboard-theme-HPE, openstack-heat-templates, openstack-keystone, openstack-monasca-agent, openstack-monasca-installer, openstack-neutron, openstack-octavia-amphora-image, python-Django, python-Flask, python-GitPython, python-Pillow, python-amqp, python-apicapi, python-keystoneauth1, python-oslo.messaging, python-psutil, python-pyroute2, python-pysaml2, python-tooz, python-waitress, storm contains the following fixes:

The update fixes several security issues:

ansible

• CVE-2019-3828: Fixed a path traversal in the fetch module (bsc#1126503).

grafana

• CVE-2020-13379: Fixed an incorrect access control issue which could lead to information leaks or denial of service (bsc#1172409).
• CVE-2020-12052: Fixed an cross site scripting vulnerability related to the annotation popup (bsc#1170657).

kibana

• CVE-2020-10743: Fixed a clickjacking vulnerability (bsc#1171909).

python-Django

• CVE-2020-13254: Fixed a data leakage via malformed memcached keys. (bsc#1172167)
• CVE-2020-13596: Fixed a cross site scripting vulnerability related to the admin parameters of the ForeignKeyRawIdWidget. (bsc#1172166)

python-Flask

• CVE-2019-1010083: Fixed a denial of service via crafted encoded JSON. (bsc#1141968)

python-Pillow

• CVE-2019-16865: Fixed a denial of service with specially crafted image files. (bsc#1153191)
• CVE-2020-5312: Fixed a buffer overflow in the PCX P mode. (bsc#1160152)
• CVE-2020-5313: Fixed a buffer overflow related to FLI. (bsc#1160153)
• CVE-2019-19911: Fixed a denial of service in FpxImagePlugin.py. (bsc#1160192)

python-psutil

• CVE-2019-18874: Fixed a double free caused by refcount mishandling. (bsc#1156525)

python-pysaml2

• CVE-2020-5390: Fixed an issue with the verification of signatures in SAML documents. (bsc#1160851)
• CVE-2017-1000246: Fixed an issue with weak encryption data, caused by initialization vector reuse. (bsc#1068612)

python-waitress (to version 1.4.3)

• CVE-2019-16785: Fixed HTTP request smuggling through LF vs CRLF handling. (bsc#1161088)
• CVE-2019-16786: Fixed HTTP request smuggling through invalid Transfer-Encoding. (bsc#1161089)
• CVE-2019-16789: Fixed HTTP Request Smuggling through Invalid whitespace characters. (bsc#1160790)
• CVE-2019-16792: Fixed HTTP Request Smuggling through Content-Length header handling. (bsc#1161670)

rubygem-activeresource

• CVE-2020-8151: Fixed information disclosure issue via specially crafted requests. (bsc#1171560)

rubygem-json-1_7

• CVE-2020-10663: Fixed an unsafe object creation vulnerability. (bsc#1167244)

rubygem-puma

• CVE-2020-11077: Fixed a HTTP smuggling issue related to proxy usage. (bsc#1172175)
• CVE-2020-11076: Fixed a HTTP smuggling issue when using an invalid transfer-encoding header. (bsc#1172176)

Other non-security fixes in in the update below:

Changes in ansible:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ansible1:

• Add 0001-Disallow-use-of-remote-home-directories-containing-..patch (bsc#1126503, CVE-2019-3828)

Changes in ardana-ansible:

• Update to version 8.0+git.1589740980.6c3bcdc:

  • Reconfigure rabbitmq user permissions on update (SOC-11082)

• Update to version 8.0+git.1588953487.9bfd5cb:

  • Fix incorrect prefix used to collect supportconfig files (bsc#1171273)

• Update to version 8.0+git.1585690828.81d8f45:

  • Cleanup keystone-ansible (bsc#1108719)

Changes in ardana-cluster:

• Update to version 8.0+git.1585685203.3e71e49:
  • Use bool filter to ensure valid boolean evaluation (SOC-11192)

Changes in ardana-freezer:

• Update to version 8.0+git.1586539529.b7d295f:
  • Recovering Cloud8 using Freezer or SSH backups…

This update for python-Pillow fixes the following issues:

• Add 0019-FLI-overflow-error-fix-and-testcase.patch
  • Fixes CVE-2016-0775, bsc#965582
• Add 0020-Fix-OOB-reads-in-FLI-decoding.patch
  • Fixes CVE-2020-10177, bsc#1173413
• Add 0021-Fix-bounds-overflow-in-JPEG-2000-decoding.patch
  • Fixes CVE-2020-10994, bsc#1173418
• Add 0022-Fix-bounds-overflow-in-PCX-decoding.patch
  • Fixes CVE-2020-10378, bsc#1173416
• Add 0008-Corrected-negative-seeks.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0009-Make-Image.crop-an-immediate-operation.patch
  • Fixes https://github.com/python-pillow/Pillow/issues/1077
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0010-Crop-decompression.patch
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0011-Added-DecompressionBombError.patch
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0012-Added-decompression-bomb-checks.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0013-Raise-error-if-dimension-is-a-string.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0014-Catch-buffer-overruns.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0015-Catch-PCX-P-mode-buffer-overrun.patch
  • Fixes CVE-2020-5312, bsc#1160152
• Add 0016-Ensure-previous-FLI-frame-is-loaded.patch
  • Fixes https://github.com/python-pillow/Pillow/issues/2649
  • Uncovers CVE-2020-5313, bsc#1160153
• Add 0017-Catch-FLI-buffer-overrun.patch
  • Fixes CVE-2020-5313, bsc#1160153
• Add 018-Invalid-number-of-bands-in-FPX-image.patch
  • Fixes CVE-2019-19911, bsc#1160192

It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to cause a denial of service. (CVE-2019-16865, CVE-2019-19911)

It was discovered that Pillow incorrectly handled certain images. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-5312)

It was discovered that Pillow incorrectly handled certain TIFF images. An attacker could possibly use this issue to cause a crash. This issue only affected Ubuntu 19.10. (CVE-2020-5310)

It was discovered that Pillow incorrectly handled certain SGI images. An attacker could possibly use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 and Ubuntu 19.10. (CVE-2020-5311)

It was discovered that Pillow incorrectly handled certain PCX images. An attackter could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5312)

It was discovered that Pillow incorrectly handled certain Flip images. An attacker could possibly use this issue to execute arbitrary code or cause a crash. (CVE-2020-5313)