VuXML ID | Description |
0519db18-cf15-11e5-805c-5453ed2e2b49 | py-pillow -- Integer overflow in Resample.c
The Pillow maintainers report:
If a large value was passed into the new size for an image, it is
possible to overflow an int32 value passed into malloc, leading the
mallocâd buffer to be undersized. These allocations are followed by
a loop that writes out of bounds. This can lead to corruption on
the heap of the Python process with attacker controlled float
data.
This issue was found by Ned Williamson.
Discovery 2016-02-05 Entry 2016-02-09 py27-pillow
py33-pillow
py34-pillow
py35-pillow
< 2.9.0_1
https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798
https://github.com/python-pillow/Pillow/issues/1710
|
53252879-cf11-11e5-805c-5453ed2e2b49 | py-pillow -- Buffer overflow in TIFF decoding code
The Pillow maintainers report:
Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on
x64 may overflow a buffer when reading a specially crafted tiff
file.
Specifically, libtiff >= 4.0.0 changed the return type of
TIFFScanlineSize from int32 to machine dependent int32|64. If the
scanline is sized so that it overflows an int32, it may be
interpreted as a negative number, which will then pass the size check
in TiffDecode.c line 236. To do this, the logical scanline size has
to be > 2gb, and for the test file, the allocated buffer size is 64k
against a roughly 4gb scan line size. Any image data over 64k is
written over the heap, causing a segfault.
This issue was found by security researcher FourOne.
Discovery 2016-02-04 Entry 2016-02-09 py27-pillow
py33-pillow
py34-pillow
py35-pillow
< 2.9.0_1
CVE-2016-0740
https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e
|
6ea60e00-cf13-11e5-805c-5453ed2e2b49 | py-imaging, py-pillow -- Buffer overflow in FLI decoding code
The Pillow maintainers report:
In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, FliDecode.c has a buffer overflow error.
There is a memcpy error where x is added to a target buffer
address. X is used in several internal temporary variable roles,
but can take a value up to the width of the image. Im->image[y]
is a set of row pointers to segments of memory that are the size of
the row. At the max y, this will write the contents of the line off
the end of the memory buffer, causing a segfault.
This issue was found by Alyssa Besseling at Atlassian.
Discovery 2016-02-05 Entry 2016-02-09 py27-pillow
py33-pillow
py34-pillow
py35-pillow
< 2.9.0_1
py27-imaging
< 1.1.7_6
CVE-2016-0775
https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec
|
a8de962a-cf15-11e5-805c-5453ed2e2b49 | py-imaging, py-pillow -- Buffer overflow in PCD decoder
The Pillow maintainers report:
In all versions of Pillow, dating back at least to the last PIL
1.1.7 release, PcdDecode.c has a buffer overflow error.
The state.buffer for PcdDecode.c is allocated based on a 3 bytes
per pixel sizing, where PcdDecode.c wrote into the buffer assuming
4 bytes per pixel. This writes 768 bytes beyond the end of the
buffer into other Python object storage. In some cases, this causes
a segfault, in others an internal Python malloc error.
Discovery 2016-02-02 Entry 2016-02-09 py27-pillow
py33-pillow
py34-pillow
py35-pillow
< 2.9.0_1
py27-imaging
< 1.1.7_6
http://openwall.com/lists/oss-security/2016/02/02/5
https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4
https://github.com/python-pillow/Pillow/issues/568
|
bc4898d5-a794-11e6-b2d3-60a44ce6887b | Pillow -- multiple vulnerabilities
Pillow reports:
Pillow prior to 3.3.2 may experience integer overflow
errors in map.c when reading specially crafted image files. This may
lead to memory disclosure or corruption.
Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check
for negative image sizes in ImagingNew in Storage.c. A negative image
size can lead to a smaller allocation than expected, leading to arbi
trary writes.
Discovery 2016-09-06 Entry 2016-12-04 py27-pillow
py33-pillow
py34-pillow
py35-pillow
< 3.3.2
http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html
https://github.com/python-pillow/Pillow/issues/2105
CVE-2016-9189
CVE-2016-9190
ports/214410
|