Bug 701828 (CVE-2019-16865)

Summary:	<dev-python/pillow-6.2.0: reading specially crafted image files leads to allocation of large amounts of memory (CVE-2019-16865)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	mgorny, python
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
See Also:	https://bugs.gentoo.org/show_bug.cgi?id=706202
Whiteboard:	B3 [noglsa cve]
Package list:	dev-python/pillow-6.2.1	Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2019-12-02 22:49:01 UTC

CVE-2019-16865 (https://nvd.nist.gov/vuln/detail/CVE-2019-16865):
  An issue was discovered in Pillow before 6.2.0. When reading specially
  crafted invalid image files, the library can either allocate very large
  amounts of memory or take an extremely long period of time to process the
  image.

Comment 1 Michał Górny archtester

2019-12-03 08:50:08 UTC

Keywords for dev-python/pillow:
            |                               |   u   |  
            | a a   a     p           s r   |   n   |  
            | l m   r i   p   h m s   p i m | e u s | r
            | p d a m a p c x p 6 3   a s i | a s l | e
            | h 6 r 6 6 p 6 8 p 8 9 s r c p | p e o | p
            | a 4 m 4 4 c 4 6 a k 0 h c v s | i d t | o
------------+-------------------------------+-------+-------
   3.4.2-r1 | + + + ~ + + + + + o o o + o o | 6 o 0 | gentoo
   5.4.1    | + + + ~ o + + + ~ o o o o o o | 7 o   | gentoo
   6.0.0    | ~ + + + o ~ ~ ~ ~ o o o o o o | 7 o   | gentoo
   6.1.0    | ~ ~ ~ ~ o ~ ~ ~ ~ o o o ~ o o | 7 #   | gentoo
   6.2.0    | ~ ~ ~ ~ o ~ ~ ~ ~ o o o ~ o o | 7 #   | gentoo
[I]6.2.1    | ~ ~ ~ ~ o ~ ~ ~ ~ o o o ~ o o | 7 o   | gentoo

Comment 2 Agostino Sarubbo gentoo-dev

2019-12-03 11:41:49 UTC

amd64 stable

Comment 3 Agostino Sarubbo gentoo-dev

2019-12-03 11:42:34 UTC

x86 stable

Comment 4 Agostino Sarubbo gentoo-dev

2019-12-03 12:27:02 UTC

ppc64 stable

Comment 5 Aaron Bauman (RETIRED) gentoo-dev

2019-12-04 02:09:16 UTC

arm64 stable

Comment 6 Agostino Sarubbo gentoo-dev

2019-12-10 10:55:54 UTC

ppc stable

Comment 7 Rolf Eike Beer archtester

2019-12-17 21:17:43 UTC

hppa/sparc stable

Comment 8 Mikle Kolyada (RETIRED) archtester

2019-12-23 09:28:07 UTC

arm stable

Comment 9 Sam James archtester

2020-03-19 01:08:27 UTC

Tree is clean.

Comment 10 NATTkA bot gentoo-dev

2020-04-06 15:00:40 UTC

Resetting sanity check; keywords are not fully specified and arches are not CC-ed.

Comment 11 Yury German Gentoo Infrastructure

2020-04-26 03:05:11 UTC

GLSA Vote: No

Thank you all for you work. 
Closing as [noglsa].