FS#70044 : [python-pillow] [Security] multiple issues (AVG-1635)

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!

FS#70044 - [python-pillow] [Security] multiple issues (AVG-1635)

Attached to Project: Community Packages
Opened by Jonas Witschel (diabonas) - Wednesday, 17 March 2021, 12:23 GMT
Last edited by Jonas Witschel (diabonas) - Saturday, 27 March 2021, 12:07 GMT

Task Type	Bug Report
Category	Security
Status	Closed
Assigned To	Kyle Keen (keenerd) Levente Polyak (anthraxx)
Architecture	All
Severity	High
Priority	Normal
Reported Version
Due in Version	Undecided
Due Date	Undecided
Percent Complete
Votes	0
Private	No

Details

Summary
=======

The package python-pillow is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service via CVE-2021-27923, CVE-2021-27922, CVE-2021-27921, CVE-2021-25293, CVE-2021-25292, CVE-2021-25291, CVE-2021-25290 and CVE-2021-25289.

Guidance
========

Upgrading python-pillow to the latest version 8.1.2 fixes the issues.

References
==========

https://security.archlinux.org/AVG-1635
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.2.html
https://github.com/python-pillow/Pillow/commit/756fff33128a0b643d10518a26ad04b726dd8973
https://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html
https://github.com/python-pillow/Pillow/commit/f891baa604636cd2506a9360d170bc2cf4963cc5
https://github.com/python-pillow/Pillow/commit/521dab94c7ab72b037bd9a83e9663401e0fd2cee
https://github.com/python-pillow/Pillow/commit/8b8076bdcb3815be0ef0d279651d8d1342b8ea61
https://github.com/python-pillow/Pillow/commit/e25be1e33dc526bfd1094bc778a54d8e29bf66c9
https://github.com/python-pillow/Pillow/commit/cbfdde7b1f2295059a20a539ee9960f0bec7b299

This task depends upon

Closed by Jonas Witschel (diabonas)
Saturday, 27 March 2021, 12:07 GMT
Reason for closing: Fixed
Additional comments about closing: python-pillow 8.1.2-1

Comments (0)
Related Tasks (0/0)

	Tasks related to this task (0)

Duplicate tasks of this task (0)

Arch Linux

Community Packages

FS#70044 - [python-pillow] [Security] multiple issues (AVG-1635)

Details

Loading...