CVE-2016-0775

Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

A buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file (CVE-2016-0740).

A buffer overflow in FliDecode.c causing a segfault when opening FLI files (CVE-2016-0775).

A buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files.

These are all security issues fixed in the python3-Pillow-3.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-Pillow-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.

This update for python-Pillow fixes the following security issues:

• Fixed an integer overflow in Resample.c causing writes in the Python heap.
• Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files. CVE-2016-TBD
• Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. CVE-2016-0775 (fixes bsc#965582)
• Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. CVE-2016-0740 (fixes bsc#965579)

This update for python-Pillow fixes the following security issues:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. (bsc#965582)
• CVE-2016-0740: Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. (bsc#965579)
• Fixed an integer overflow in Resample.c causing writes in the Python heap.
• Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files.

This update for python-Pillow fixes the following security issues:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. (bsc#965582)
• CVE-2016-0740: Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. (bsc#965579)
• Fixed an integer overflow in Resample.c causing writes in the Python heap.
• Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files.

This update for python-Pillow fixes the following security issues:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c causing a segfault when opening FLI files. (bsc#965582)
• CVE-2016-0740: Fixed a buffer overflow in TiffDecode.c causing an arbitrary amount of memory to be overwritten when opening a specially crafted invalid TIFF file. (bsc#965579)
• Fixed an integer overflow in Resample.c causing writes in the Python heap.
• Fixed a buffer overflow in PcdDecode.c causing a segfault when opening PhotoCD files.

This update for python-Pillow fixes the following issues:

• Add 0019-FLI-overflow-error-fix-and-testcase.patch
  • Fixes CVE-2016-0775, bsc#965582
• Add 0020-Fix-OOB-reads-in-FLI-decoding.patch
  • Fixes CVE-2020-10177, bsc#1173413
• Add 0021-Fix-bounds-overflow-in-JPEG-2000-decoding.patch
  • Fixes CVE-2020-10994, bsc#1173418
• Add 0022-Fix-bounds-overflow-in-PCX-decoding.patch
  • Fixes CVE-2020-10378, bsc#1173416
• Add 0008-Corrected-negative-seeks.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0009-Make-Image.crop-an-immediate-operation.patch
  • Fixes https://github.com/python-pillow/Pillow/issues/1077
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0010-Crop-decompression.patch
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0011-Added-DecompressionBombError.patch
  • Used by 0012-Added-decompression-bomb-checks.patch
• Add 0012-Added-decompression-bomb-checks.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0013-Raise-error-if-dimension-is-a-string.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0014-Catch-buffer-overruns.patch
  • Fixes part of CVE-2019-16865, bsc#1153191
• Add 0015-Catch-PCX-P-mode-buffer-overrun.patch
  • Fixes CVE-2020-5312, bsc#1160152
• Add 0016-Ensure-previous-FLI-frame-is-loaded.patch
  • Fixes https://github.com/python-pillow/Pillow/issues/2649
  • Uncovers CVE-2020-5313, bsc#1160153
• Add 0017-Catch-FLI-buffer-overrun.patch
  • Fixes CVE-2020-5313, bsc#1160153
• Add 018-Invalid-number-of-bands-in-FPX-image.patch
  • Fixes CVE-2019-19911, bsc#1160192

This update for ansible, crowbar-core, crowbar-openstack, grafana, grafana-natel-discrete-panel, openstack-aodh, openstack-barbican, openstack-cinder, openstack-gnocchi, openstack-heat, openstack-ironic, openstack-magnum, openstack-manila, openstack-monasca-agent, openstack-murano, openstack-neutron, openstack-neutron-vpnaas, openstack-nova, openstack-sahara, python-Pillow, rubygem-crowbar-client fixes the following issues:

Security fixes included on this update:

for ansible:

• CVE-2020-1733,CVE-2020-10744: Fixed a race condition and insecure permissions which could have allowed another user on the node to gain control of the become user (bsc#1171823 and bsc#1164140).

for grafana:

• CVE-2020-11110, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed XSS vulnerabilities in dashboard due to an incomplete fix for CVE-2018-12099

for openstack-nova:

• CVE-2020-17376: Fixed an issue in which live migration failed to update persistent domain XML (bsc#1175484)

for python-pillow:

• CVE-2016-0775: Fixed a buffer overflow in FliDecode.c (bsc#965582)
• CVE-2020-10177: Fix-OOB-reads-in-FLI-decoding (bsc#1173413)
• CVE-2020-10994: Fix-bounds-overflow-in-JPEG-2000-decoding (bsc#1173418)
• CVE-2020-10378: Fix-bounds-overflow-in-PCX-decoding (bsc#1173416)

for rubygem-crowbar-client:

• CVE-2018-17954: Fixed an issue where provision leaks admin password to all nodes in cleartext (bsc#1117080)

Non-security fixes included on this update:

Changes in ansible:

• Update CVE-2020-10744_avoid_mkdir_p.patch to include missing parts and rename to CVE-2020-1733_avoid_mkdir_p.patch to make it clear which CVE is fixed there (bsc#1164140)

• Add CVE-2020-10744_avoid_mkdir_p.patch (bsc#1171823) to fix insecure temporary directory creation.

Changes in crowbar-core:

• Update to version 4.0+git.1600767499.0615a418f:

  • provisioner: check for client_user (SOC-11389)
  • crowbar: Also add access to /restricted/ in SSL vhost (SOC-11352)
  • crowbar: Allow hardware-installing -> discovering transition (noref)
  • crowbar: Add Restricted controller with API for restricted clients (bsc#1117080)
  • crowbar: Add complete list of states to Crowbar::State (noref)
  • provisioner: Remove the need for /updates/parse_node_data (noref)
  • crowbar: Create helper module to validate states (noref)
  • provisioner: Use new restricted API (bsc#1117080)
  • provisioner: Do not read /etc/crowbar.install.key from crowbar_joi (bsc#1117080)
  • provisioner: Remove use of privileged user for Windows machine (bsc#1117080)
  • provisioner: Use restricted client during provisioning (bsc#1117080)
  • provisioner: Use restricted client for crowbar_register (bsc#1117080)
  • provisioner: Drop /etc/crowbar.install.key bits from autoyast prof (bsc#1117080)
  • Avoid hardcoding machine-install user (bsc#1117080)
  • crowbar: Restrict admin access (bsc#1117080)

• Update to version 4.0+git.1600416364.5a9286e31:

  • Whitelist fixed CVEs in travis (noref)
  • Disable cookbook tests (noref)

Changes in crowbar-openstack:

• Update to version 4.0+git.1599037255.25b759234:
  • horizon: Update configuration for Grafana 5.x

Changes in grafana:

• BuildRequire go1.14 explicitly
• Add recompress source service
• Add go_modules source service to create vendor.tar.gz containing 3rd party go modules.
• Adjust spec to work for Grafana-6.7.4
• Adjust Makefile to work for Grafana-6.7.4
• Remove CVE-2019-15043.patch (merged upstream)
• Remove CVE-2020-13379.patch (merged upstream)
• Remove 0001-CVE-2020-12052-bsc1170657-XSS-annotation-popup-vulnerability.patch (merged upstream)
• Update to version 6.7.4 (bsc#1172450, CVE-2018-18623, CVE-2018-18624, CVE-2018-18625, bsc#1174583, CVE-2020-11110)
  • Only allow 32 hexadecimal digits for the avatar hash
  • 6.7.3 cherry-picks (#23808)
  • Fix CI for pushing a multi-architecture manifest (#23327)
  • AzureMonitor: Fix Log Analytics and Application Insights for Azure China (#21803) (#22753)
  • Revert 'grafana/data:…

It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601)

Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589)

Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)