Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 599610 (CVE-2016-9190)

Summary: <dev-python/pillow-3.4.2: Missing check for negative image dimensions in ImagingNew (Storage.c)
Product: Gentoo Security Reporter: Ian Zimmerman <nobrowser>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: ago, python
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9190
Whiteboard: A4 [glsa cve]
Package list:
Runtime testing required: ---
Bug Depends on:    
Bug Blocks: 507982, 573958, 596356, 599608, 599612    

Description Ian Zimmerman 2016-11-12 18:43:48 UTC
According to the RedHat summary:

It was found that in storage.c, the image size is not checked for negative values. This can lead to a null pointer dereference in 3.3.x, or a dereference of junk memory prior to that.

Upstream patch:

https://github.com/python-pillow/Pillow/commit/5d8a0be45aad78c5a22c8d099118ee26ef8144af


Reproducible: Always
Comment 1 Aaron Bauman Gentoo Infrastructure gentoo-dev Security 2016-11-17 09:19:55 UTC
We have pinged the Python team in other Pillow bugs so I am calling for stable due to timeout.

@arches, please stabilize:

=dev-python/pillow-3.4.2
Comment 2 Agostino Sarubbo gentoo-dev 2016-11-17 12:43:38 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-11-17 12:44:39 UTC
x86 stable
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2016-11-19 08:35:35 UTC
Stable for HPPA PPC64.
Comment 5 Agostino Sarubbo gentoo-dev 2016-11-27 11:37:36 UTC
arm stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-11-27 11:40:39 UTC
ppc stable
Comment 7 Mike Gilbert gentoo-dev 2016-11-28 02:13:23 UTC
I revbumped pillow-3.4.2 to resolve a file collision (bug 600694).

Remaining archs should proceed with dev-python/pillow-3.4.2-r1 instead.
Comment 8 Agostino Sarubbo gentoo-dev 2016-11-28 09:35:53 UTC
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2016-11-28 09:39:06 UTC
ia64 stable.

Maintainer(s), please cleanup.
Comment 10 Thomas Deutschmann gentoo-dev Security 2016-11-29 01:09:07 UTC
*** Bug 596356 has been marked as a duplicate of this bug. ***
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2016-12-31 14:26:16 UTC
This issue was resolved and addressed in
 GLSA 201612-52 at https://security.gentoo.org/glsa/201612-52
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 12 Thomas Deutschmann gentoo-dev Security 2016-12-31 14:32:25 UTC
Re-opening for cleanup.

@ Maintainer(s): Please either drop <dev-python/pillow-3.4.2-r1 or apply package masks indicating a security problem.
Comment 13 Mike Gilbert gentoo-dev 2017-01-01 02:59:32 UTC
Cleanup done.