Security update for python-Pillow SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:1772-1 Final 1 1 2019-07-08T15:11:44Z current 2019-07-08T15:11:44Z 2019-07-08T15:11:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Pillow This update for python-Pillow fixes the following issues: Security issue fixed: - CVE-2016-9189: Fixed a integer overflows leading to memory disclosure in PyImaging_MapBuffer() (bsc#1008845). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-1772,SUSE-OpenStack-Cloud-7-2019-1772,SUSE-Storage-4-2019-1772 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20191772-1/ Link for SUSE-SU-2019:1772-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005672.html E-Mail link for SUSE-SU-2019:1772-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1008845 SUSE Bug 1008845 https://www.suse.com/security/cve/CVE-2016-9189/ SUSE CVE CVE-2016-9189 page SUSE Enterprise Storage 4 SUSE OpenStack Cloud 7 python-Pillow-2.8.1-4.6.1 python-Pillow-tk-2.8.1-4.6.1 python-Pillow-2.8.1-4.6.1 as a component of SUSE Enterprise Storage 4 python-Pillow-2.8.1-4.6.1 as a component of SUSE OpenStack Cloud 7 Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the "crafted image file" approach, related to an "Integer Overflow" issue affecting the Image.core.map_buffer in map.c component. CVE-2016-9189 SUSE Enterprise Storage 4:python-Pillow-2.8.1-4.6.1 SUSE OpenStack Cloud 7:python-Pillow-2.8.1-4.6.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20191772-1/ https://www.suse.com/security/cve/CVE-2016-9189.html CVE-2016-9189 https://bugzilla.suse.com/1008845 SUSE Bug 1008845