CVE-2023-44271

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. %package -n python3-pillow Summary: Python 3 image processing library Provides: python3-imaging = -

Security Fix(es):

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.(CVE-2023-44271)

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (CVE-2023-44271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

TuxCare rebuilt pillow to address 1 CVE. Fixed in 9.4.0.post1+tuxcare.

TuxCare rebuilt pillow to address 1 CVE. Fixed in 9.4.0.post4+tuxcare.

TuxCare rebuilt pillow to address 5 CVEs. Fixed in 9.5.0.post3+tuxcare.

• SECURITY UPDATE: arbitrary code execution via the ImageMath.eval environment parameter (ELSCVE-187962)
  • debian/patches/CVE-2023-50447.patch: reject environment keys that contain "__" or shadow a builtin before they are merged into the execution namespace in src/PIL/ImageMath.py, so an injected name can no longer satisfy the expression allowlist. Adds a regression test in Tests/test_imagemath.py.
  • CVE-2023-50447
• SECURITY UPDATE: denial of service via unbounded allocation when measuring or rendering very long strings
  • debian/patches/CVE-2023-44271.patch: add ImageFont.MAX_STRING_LENGTH and check it at each text entry point in src/PIL/ImageFont.py before the C layer allocates. Adds a regression test in Tests/test_imagefont.py.
  • CVE-2023-44271

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 8.4.0.post2+tuxcare.

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

CVE-2023-44271 Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. CVE-2024-28219 A buffer overflow exists because strcpy is used instead of strncpy.

These are all security issues fixed in the python310-Pillow-10.0.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (CVE-2023-44271)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Root has patched CVE-2023-44271 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• CVE-2023-44271: Fixed uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (bsc#1216894).

This update for python-Pillow fixes the following issues:

• CVE-2023-44271: Fixed uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (bsc#1216894).

This update for python-Pillow fixes the following issues:

• CVE-2023-44271: Fixed uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (bsc#1216894).

This update for python-Pillow fixes the following issues:

• CVE-2023-44271: Fixed uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument (bsc#1216894).

It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)

Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)