CVE-2014-3589

PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.

Updated python-imaging and python-pillow packages fix security vulnerabilities:

The Python Imaging Library is vulnerable to a denial of service attack in the IcnsImagePlugin (CVE-2014-3589).

These are all security issues fixed in the python3-Pillow-3.4.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python-Pillow-3.1.1-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.

PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.

python-pillow has been updated to 2.7.0 to fix three security issues.

The following vulnerabilities have been fixed:

* CVE-2014-9601: Remote attackers could have caused a denial of service
  via a compressed text chunk in a PNG image that has a large size when
  it is decompressed.
* CVE-2014-3598: Remote attackers could have caused a denial of service
  using specially crafted image files via Jpeg2KImagePlugin.
* CVE-2014-3589: Remote attackers could have caused a denial of service
  using specially crafted image files via IcnsImagePlugin.
* CVE-2014-1932: A local user could have overwritten arbitrary files
  and obtain sensitive information via a symlink attack on the
  temporary file.
* CVE-2014-1933: A local user could have gained information helpful for
  symlink attacks by listing process information which uses the names
  of temporary files on the command line.

Security Issues:

* CVE-2014-9601
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601>
* CVE-2014-3598
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598>
* CVE-2014-3589
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589>
* CVE-2014-1932
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932>
* CVE-2014-1933
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933>

This collective update for SUSE Enterprise Storage 1.0 provides fixes and enhancements.

ceph (update to version 0.80.9):

• Support non-ASCII characters. (bnc#907510)
• Fixes issue with more than one OSD / MON on same node. (bnc#927862)
• Reinstates Environment=CLUSTER=ceph lines removed by last patch. (bnc#915567)
• Use same systemd service files for all cluster names. (bnc#915567)
• In OSDMonitor fallback to json-pretty in case of invalid formatter. (bnc#919313)
• Increase max files to 131072 for ceph-osd daemon. (bnc#924894)
• Fix 'OSDs shutdown during rados benchmark tests'. (bnc#924269)
• Add SuSEfirewall2 service files for Ceph MON, OSD and MDS. (bnc#919091)
• Added support for multiple cluster names with systemd to ceph-disk. (bnc#915567)
• Move udev rules for rbd devices to the client package ceph-common.
• Several issues reported upstream have been fixed: #9973 #9918 #9907 #9877 #9854 #9587 #9479 #9478 #9254 #5595 #10978 #10965 #10907 #10553 #10471 #10421 #10307 #10299 #10271 #10271 #10270 #10262 #10103 #10095.

ceph-deploy:

• Drop support for multiple customer names on the same hardware. (bsc#915567)
• Check for errors when generating rgw keys. (bsc#915783)
• Do not import new repository keys automatically when installing packages with Zypper. (bsc#919965)
• Improved detection of disk vs. OSD block devices with a simple set of tests. (bsc#889053)
• Do not create keyring files as world-readable. (bsc#920926, CVE-2015-3010)
• Added support for multiple cluster names with systemd to ceph-disk. (bnc#915567)

calamari-clients:

• Reduce krakenFailThreshold to 5 minutes. (bsc#903007)

python-Pillow (update to version 2.7.0):

• Fix issues in Jpeg2KImagePlugin and IcnsImagePlugin which could have allowed denial of service attacks. (CVE-2014-3598, CVE-2014-3589)

python-djangorestframework:

• Escape URLs when replacing format= query parameter, as used in dropdown on GET button in browsable API to allow explicit selection of JSON vs HTML output. (bsc#929914)
• Escape request path when it is include as part of the login and logout links in the browsable API. (bsc#929886)

For a comprehensive list of changes please refer to each package's change log.

PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.

It was discovered that a flaw in processing a compressed text chunk in a PNG image could cause the image to have a large size when decompressed, potentially leading to a denial of service. (CVE-2014-9601)

Andrew Drake discovered that Pillow incorrectly validated input. A remote attacker could use this to cause Pillow to crash, resulting in a denial of service. (CVE-2014-3589)

Eric Soroos discovered that Pillow incorrectly handled certain malformed FLI, Tiff, and PhotoCD files. A remote attacker could use this issue to cause Pillow to crash, resulting in a denial of service. (CVE-2016-0740, CVE-2016-0775, CVE-2016-2533)