CVE-2020-35655

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.(CVE-2020-35655)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.(CVE-2021-27921)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.(CVE-2021-27922)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.(CVE-2021-27923)

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.(CVE-2020-35655)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.(CVE-2021-27921)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.(CVE-2021-27922)

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.(CVE-2021-27923)

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

This update for python-CairoSVG, python-Pillow fixes the following issues:

Update to version 2.5.1.

• Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time.
• Fix marker positions for unclosed paths
• Follow hint when only output_width or output_height is set
• Handle opacity on raster images
• Don’t crash when use tags reference unknown tags
• Take care of the next letter when A/a is replaced by l
• Fix misalignment in node.vertices

Updates for version 2.5.0.

• Drop support of Python 3.5, add support of Python 3.9.
• Add EPS export
• Add background-color, negate-colors, and invert-images options
• Improve support for font weights
• Fix opacity of patterns and gradients
• Support auto-start-reverse value for orient
• Draw images contained in defs
• Add Exif transposition support
• Handle dominant-baseline
• Support transform-origin

python-Pillow update to version 8.3.1:

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

• Moved CVE image to pillow-depends #5561 [radarhere]

• Added tag data for IFD groups #5554 [radarhere]

• Improved ImagePalette #5552 [radarhere]

• Add DDS saving #5402 [radarhere]

• Improved getxmp() #5455 [radarhere]

• Convert to float for comparison with float in IFDRational eq #5412 [radarhere]

• Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

• Read FITS image mode and size #5405 [radarhere]

• Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

• Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

• Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

• Copy palette to new images in ImageOps expand #5551 [radarhere]

• Ensure palette string matches RGB mode #5549 [radarhere]

• Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

• Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

• Added DDS BC5 reading #5501 [radarhere]

• Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

• Added ICO saving in BMP format #5513 [radarhere]

• Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

• Do not allow TIFF to seek to a past frame #5473 [radarhere]

• Avoid race condition when displaying images with eog #5507 [mconst]

• Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

• Allow converting an image to a numpy array to raise errors #5379 [radarhere]

• Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

• Remove spikes when drawing thin pieslices #5460 [xtsm]

• Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

• Removed TIFF DPI rounding #5446 [radarhere, hugovk]

• Include code in WebP error #5471 [radarhere]

• Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

• Reset handle when seeking backwards in TIFF #5443 [radarhere]

• Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

• Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

• Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

• Do not round dimensions…

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.

This update for python-Pillow fixes the following issues:

• CVE-2020-35655: Fixed a buffer over-read when decoding crafted SGI RLE image files (bsc#1180832).
• CVE-2021-25293: Fixed an out-of-bounds read in SGIRleDecode.c (bsc#1183102).
• CVE-2021-25290: Fixed a negative-offset memcpy with an invalid size in TiffDecode.c (bsc#1183105).
• CVE-2021-25292: Fixed a backtracking regex in PDF parser could be used as a DOS attack (bsc#1183101).
• CVE-2021-27921,CVE-2021-27922,CVE-2021-27923: Fixed improper reported size of a contained image (bsc#1183110,bsc#1183108,bsc#1183107)
• CVE-2020-35653: Fixed buffer over-read in PcxDecode when decoding a crafted PCX file (bsc#1180834).
• CVE-2021-25287: Fixed out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805).
• CVE-2021-25288: Fixed out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803).
• CVE-2021-28675: Fixed DoS in PsdImagePlugin (bsc#1185804).
• CVE-2021-28678: Fixed improper check in BlpImagePlugin (bsc#1185784).
• CVE-2021-28677: Fixed DoS in the open phase via a malicious EPS file (bsc#1185785).
• CVE-2021-28676: Fixed infinite loop in FliDecode.c (bsc#1185786).

It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-2020-35653)

It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain SGI image files. If a user or automated system were tricked into opening a specially-crafted SGI file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-35655)