Security update for python-Pillow SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0777-1 Final 1 1 2015-04-22T14:27:27Z current 2015-04-22T14:27:27Z 2015-04-22T14:27:27Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Pillow python-pillow has been updated to 2.7.0 to fix three security issues. The following vulnerabilities have been fixed: * CVE-2014-9601: Remote attackers could have caused a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. * CVE-2014-3598: Remote attackers could have caused a denial of service using specially crafted image files via Jpeg2KImagePlugin. * CVE-2014-3589: Remote attackers could have caused a denial of service using specially crafted image files via IcnsImagePlugin. * CVE-2014-1932: A local user could have overwritten arbitrary files and obtain sensitive information via a symlink attack on the temporary file. * CVE-2014-1933: A local user could have gained information helpful for symlink attacks by listing process information which uses the names of temporary files on the command line. Security Issues: * CVE-2014-9601 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601> * CVE-2014-3598 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598> * CVE-2014-3589 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589> * CVE-2014-1932 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932> * CVE-2014-1933 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleclo50sp3-python-Pillow Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ Link for SUSE-SU-2015:0777-1 https://lists.suse.com/pipermail/sle-security-updates/2015-April/001361.html E-Mail link for SUSE-SU-2015:0777-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/921566 SUSE Bug 921566 https://www.suse.com/security/cve/CVE-2014-1932/ SUSE CVE CVE-2014-1932 page https://www.suse.com/security/cve/CVE-2014-1933/ SUSE CVE CVE-2014-1933 page https://www.suse.com/security/cve/CVE-2014-3589/ SUSE CVE CVE-2014-3589 page https://www.suse.com/security/cve/CVE-2014-3598/ SUSE CVE CVE-2014-3598 page https://www.suse.com/security/cve/CVE-2014-9601/ SUSE CVE CVE-2014-9601 page SUSE OpenStack Cloud 5 python-Pillow-2.7.0-0.7.1 python-Pillow-2.7.0-0.7.1 as a component of SUSE OpenStack Cloud 5 The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file. CVE-2014-1932 SUSE OpenStack Cloud 5:python-Pillow-2.7.0-0.7.1 moderate 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ https://www.suse.com/security/cve/CVE-2014-1932.html CVE-2014-1932 https://bugzilla.suse.com/863541 SUSE Bug 863541 https://bugzilla.suse.com/921566 SUSE Bug 921566 The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes. CVE-2014-1933 SUSE OpenStack Cloud 5:python-Pillow-2.7.0-0.7.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ https://www.suse.com/security/cve/CVE-2014-1933.html CVE-2014-1933 https://bugzilla.suse.com/863541 SUSE Bug 863541 https://bugzilla.suse.com/921566 SUSE Bug 921566 PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size. CVE-2014-3589 SUSE OpenStack Cloud 5:python-Pillow-2.7.0-0.7.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ https://www.suse.com/security/cve/CVE-2014-3589.html CVE-2014-3589 https://bugzilla.suse.com/921566 SUSE Bug 921566 The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image. CVE-2014-3598 SUSE OpenStack Cloud 5:python-Pillow-2.7.0-0.7.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ https://www.suse.com/security/cve/CVE-2014-3598.html CVE-2014-3598 https://bugzilla.suse.com/921566 SUSE Bug 921566 Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed. CVE-2014-9601 SUSE OpenStack Cloud 5:python-Pillow-2.7.0-0.7.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/ https://www.suse.com/security/cve/CVE-2014-9601.html CVE-2014-9601 https://bugzilla.suse.com/921566 SUSE Bug 921566