Bug 599610 (CVE-2016-9190)

Summary:	<dev-python/pillow-3.4.2: Missing check for negative image dimensions in ImagingNew (Storage.c)
Product:	Gentoo Security	Reporter:	Ian Zimmerman <nobrowser>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	ago, python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9190
Whiteboard:	A4 [glsa cve]
Package list:		Runtime testing required:	---
Bug Depends on:
Bug Blocks:	507982, 573958, 596356, 599608, 599612

Description Ian Zimmerman 2016-11-12 18:43:48 UTC

According to the RedHat summary:

It was found that in storage.c, the image size is not checked for negative values. This can lead to a null pointer dereference in 3.3.x, or a dereference of junk memory prior to that.

Upstream patch:

https://github.com/python-pillow/Pillow/commit/5d8a0be45aad78c5a22c8d099118ee26ef8144af


Reproducible: Always

Comment 1 Aaron Bauman (RETIRED) gentoo-dev

2016-11-17 09:19:55 UTC

We have pinged the Python team in other Pillow bugs so I am calling for stable due to timeout.

@arches, please stabilize:

=dev-python/pillow-3.4.2

Comment 2 Agostino Sarubbo gentoo-dev

2016-11-17 12:43:38 UTC

amd64 stable

Comment 3 Agostino Sarubbo gentoo-dev

2016-11-17 12:44:39 UTC

x86 stable

Comment 4 Jeroen Roovers (RETIRED) gentoo-dev

2016-11-19 08:35:35 UTC

Stable for HPPA PPC64.

Comment 5 Agostino Sarubbo gentoo-dev

2016-11-27 11:37:36 UTC

arm stable

Comment 6 Agostino Sarubbo gentoo-dev

2016-11-27 11:40:39 UTC

ppc stable

Comment 7 Mike Gilbert gentoo-dev

2016-11-28 02:13:23 UTC

I revbumped pillow-3.4.2 to resolve a file collision (bug 600694).

Remaining archs should proceed with dev-python/pillow-3.4.2-r1 instead.

Comment 8 Agostino Sarubbo gentoo-dev

2016-11-28 09:35:53 UTC

sparc stable

Comment 9 Agostino Sarubbo gentoo-dev

2016-11-28 09:39:06 UTC

ia64 stable.

Maintainer(s), please cleanup.

Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev

2016-11-29 01:09:07 UTC

*** Bug 596356 has been marked as a duplicate of this bug. ***

Comment 11 GLSAMaker/CVETool Bot gentoo-dev

2016-12-31 14:26:16 UTC

This issue was resolved and addressed in
 GLSA 201612-52 at https://security.gentoo.org/glsa/201612-52
by GLSA coordinator Thomas Deutschmann (whissi).

Comment 12 Thomas Deutschmann (RETIRED) gentoo-dev

2016-12-31 14:32:25 UTC

Re-opening for cleanup.

@ Maintainer(s): Please either drop <dev-python/pillow-3.4.2-r1 or apply package masks indicating a security problem.

Comment 13 Mike Gilbert gentoo-dev

2017-01-01 02:59:32 UTC

Cleanup done.