CVE-2020-35653

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.

Security Fix(es):

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.(CVE-2020-35653)

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

The python-pillow packages contain a Python image processing library that provides extensive file format support, an efficient internal representation, and powerful image-processing capabilities.

Security Fix(es):

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25287)

• python-pillow: Out-of-bounds read in J2K image reader (CVE-2021-25288)

• python-pillow: Negative-offset memcpy in TIFF image reader (CVE-2021-25290)

• python-pillow: Regular expression DoS in PDF format parser (CVE-2021-25292)

• python-pillow: Out-of-bounds read in SGI RLE image reader (CVE-2021-25293)

• python-pillow: Excessive memory allocation in BLP image reader (CVE-2021-27921)

• python-pillow: Excessive memory allocation in ICNS image reader (CVE-2021-27922)

• python-pillow: Excessive memory allocation in ICO image reader (CVE-2021-27923)

• python-pillow: Excessive memory allocation in PSD image reader (CVE-2021-28675)

• python-pillow: Infinite loop in FLI image reader (CVE-2021-28676)

• python-pillow: Excessive CPU use in EPS image reader (CVE-2021-28677)

• python-pillow: Excessive looping in BLP image reader (CVE-2021-28678)

• python-pillow: Buffer overflow in image convert function (CVE-2021-34552)

• python-pillow: Buffer over-read in PCX image reader (CVE-2020-35653)

• python-pillow: Buffer over-read in SGI RLE image reader (CVE-2020-35655)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

This update for python-CairoSVG, python-Pillow fixes the following issues:

Update to version 2.5.1.

• Security fix: When processing SVG files, CairoSVG was using two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provided a malicious SVG, it could make CairoSVG get stuck processing the file for a very long time.
• Fix marker positions for unclosed paths
• Follow hint when only output_width or output_height is set
• Handle opacity on raster images
• Don’t crash when use tags reference unknown tags
• Take care of the next letter when A/a is replaced by l
• Fix misalignment in node.vertices

Updates for version 2.5.0.

• Drop support of Python 3.5, add support of Python 3.9.
• Add EPS export
• Add background-color, negate-colors, and invert-images options
• Improve support for font weights
• Fix opacity of patterns and gradients
• Support auto-start-reverse value for orient
• Draw images contained in defs
• Add Exif transposition support
• Handle dominant-baseline
• Support transform-origin

python-Pillow update to version 8.3.1:

• Catch OSError when checking if fp is sys.stdout #5585 [radarhere]

• Handle removing orientation from alternate types of EXIF data #5584 [radarhere]

• Make Image.array take optional dtype argument #5572 [t-vi, radarhere]

• Use snprintf instead of sprintf. CVE-2021-34552 #5567 [radarhere]

• Limit TIFF strip size when saving with LibTIFF #5514 [kmilos]

• Allow ICNS save on all operating systems #4526 [baletu, radarhere, newpanjing, hugovk]

• De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #4989 [gofr, radarhere]

• Replaced xml.etree.ElementTree #5565 [radarhere]

• Moved CVE image to pillow-depends #5561 [radarhere]

• Added tag data for IFD groups #5554 [radarhere]

• Improved ImagePalette #5552 [radarhere]

• Add DDS saving #5402 [radarhere]

• Improved getxmp() #5455 [radarhere]

• Convert to float for comparison with float in IFDRational eq #5412 [radarhere]

• Allow getexif() to access TIFF tag_v2 data #5416 [radarhere]

• Read FITS image mode and size #5405 [radarhere]

• Merge parallel horizontal edges in ImagingDrawPolygon #5347 [radarhere, hrdrq]

• Use transparency behind first GIF frame and when disposing to background #5557 [radarhere, zewt]

• Avoid unstable nature of qsort in Quant.c #5367 [radarhere]

• Copy palette to new images in ImageOps expand #5551 [radarhere]

• Ensure palette string matches RGB mode #5549 [radarhere]

• Do not modify EXIF of original image instance in exif_transpose() #5547 [radarhere]

• Fixed default numresolution for small JPEG2000 images #5540 [radarhere]

• Added DDS BC5 reading #5501 [radarhere]

• Raise an error if ImageDraw.textbbox is used without a TrueType font #5510 [radarhere]

• Added ICO saving in BMP format #5513 [radarhere]

• Ensure PNG seeks to end of previous chunk at start of load_end #5493 [radarhere]

• Do not allow TIFF to seek to a past frame #5473 [radarhere]

• Avoid race condition when displaying images with eog #5507 [mconst]

• Added specific error messages when ink has incorrect number of bands #5504 [radarhere]

• Allow converting an image to a numpy array to raise errors #5379 [radarhere]

• Removed DPI rounding from BMP, JPEG, PNG and WMF loading #5476, #5470 [radarhere]

• Remove spikes when drawing thin pieslices #5460 [xtsm]

• Updated default value for SAMPLESPERPIXEL TIFF tag #5452 [radarhere]

• Removed TIFF DPI rounding #5446 [radarhere, hugovk]

• Include code in WebP error #5471 [radarhere]

• Do not alter pixels outside mask when drawing text on an image with transparency #5434 [radarhere]

• Reset handle when seeking backwards in TIFF #5443 [radarhere]

• Replace sys.stdout with sys.stdout.buffer when saving #5437 [radarhere]

• Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #5426 [radarhere]

• Fixed bug when checking FreeType2 version if it is not installed #5445 [radarhere]

• Do not round dimensions…

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.

Root has patched CVE-2020-35653 in the pillow package for Root:PyPI. Multiple fixed versions available.

This update for python-Pillow fixes the following issues:

• CVE-2020-35655: Fixed a buffer over-read when decoding crafted SGI RLE image files (bsc#1180832).
• CVE-2021-25293: Fixed an out-of-bounds read in SGIRleDecode.c (bsc#1183102).
• CVE-2021-25290: Fixed a negative-offset memcpy with an invalid size in TiffDecode.c (bsc#1183105).
• CVE-2021-25292: Fixed a backtracking regex in PDF parser could be used as a DOS attack (bsc#1183101).
• CVE-2021-27921,CVE-2021-27922,CVE-2021-27923: Fixed improper reported size of a contained image (bsc#1183110,bsc#1183108,bsc#1183107)
• CVE-2020-35653: Fixed buffer over-read in PcxDecode when decoding a crafted PCX file (bsc#1180834).
• CVE-2021-25287: Fixed out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805).
• CVE-2021-25288: Fixed out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803).
• CVE-2021-28675: Fixed DoS in PsdImagePlugin (bsc#1185804).
• CVE-2021-28678: Fixed improper check in BlpImagePlugin (bsc#1185784).
• CVE-2021-28677: Fixed DoS in the open phase via a malicious EPS file (bsc#1185785).
• CVE-2021-28676: Fixed infinite loop in FliDecode.c (bsc#1185786).

This update for python-Pillow fixes the following issues:

• CVE-2021-25292: Fixed a backtracking regex in PDF parser could be used as a DOS attack (bsc#1183101).
• CVE-2021-25290: Fixed a negative-offset memcpy with an invalid size in TiffDecode.c (bsc#1183105).
• CVE-2021-27922,CVE-2021-27923: Fixed improper reported size of a contained image (bsc#1183108,bsc#1183107)
• CVE-2020-35653: Fixed buffer over-read in PcxDecode when decoding a crafted PCX file (bsc#1180834).
• CVE-2021-25287: Fixed out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805).
• CVE-2021-25288: Fixed out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803).
• CVE-2021-28675: Fixed DoS in PsdImagePlugin (bsc#1185804).
• CVE-2021-28677: Fixed DoS in the open phase via a malicious EPS file (bsc#1185785).
• CVE-2021-28676: Fixed infinite loop in FliDecode.c (bsc#1185786).

This update for python-Pillow fixes the following issues:

• CVE-2021-25290: Fixed a negative-offset memcpy with an invalid size in TiffDecode.c (bsc#1183105).
• CVE-2021-27922,CVE-2021-27923: Fixed improper reported size of a contained image (bsc#1183108,bsc#1183107)
• CVE-2020-35653: Fixed buffer over-read in PcxDecode when decoding a crafted PCX file (bsc#1180834).
• CVE-2021-25287: Fixed out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805).
• CVE-2021-25288: Fixed out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803).
• CVE-2021-28675: Fixed DoS in PsdImagePlugin (bsc#1185804).
• CVE-2021-28677: Fixed DoS in the open phase via a malicious EPS file (bsc#1185785).
• CVE-2021-28676: Fixed infinite loop in FliDecode.c (bsc#1185786).

It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-2020-35653)

It was discovered that Pillow incorrectly handled certain Tiff image files. If a user or automated system were tricked into opening a specially-crafted Tiff file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 20.04 LTS and Ubuntu 20.10. (CVE-2020-35654)

It was discovered that Pillow incorrectly handled certain SGI image files. If a user or automated system were tricked into opening a specially-crafted SGI file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. (CVE-2020-35655)

USN-4697-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-2020-35653)

It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted image file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. (CVE-2020-10177)