Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 599610 (CVE-2016-9190) - <dev-python/pillow-3.4.2: Missing check for negative image dimensions in ImagingNew (Storage.c)
Summary: <dev-python/pillow-3.4.2: Missing check for negative image dimensions in Imag...
Status: RESOLVED FIXED
Alias: CVE-2016-9190
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.redhat.com/show_bug....
Whiteboard: A4 [glsa cve]
Keywords:
: 596356 (view as bug list)
Depends on:
Blocks: CVE-2014-1933 CVE-2016-0740 596356 CVE-2016-9189 CVE-2016-2533, CVE-2016-4009
  Show dependency tree
 
Reported: 2016-11-12 18:43 UTC by Ian Zimmerman
Modified: 2017-01-01 06:33 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ian Zimmerman 2016-11-12 18:43:48 UTC 
According to the RedHat summary:

It was found that in storage.c, the image size is not checked for negative values. This can lead to a null pointer dereference in 3.3.x, or a dereference of junk memory prior to that.

Upstream patch:

https://github.com/python-pillow/Pillow/commit/5d8a0be45aad78c5a22c8d099118ee26ef8144af


Reproducible: Always
Comment 1 Aaron Bauman (RETIRED) gentoo-dev 2016-11-17 09:19:55 UTC 
We have pinged the Python team in other Pillow bugs so I am calling for stable due to timeout.

@arches, please stabilize:

=dev-python/pillow-3.4.2
Comment 2 Agostino Sarubbo gentoo-dev 2016-11-17 12:43:38 UTC 
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2016-11-17 12:44:39 UTC 
x86 stable
Comment 4 Jeroen Roovers (RETIRED) gentoo-dev 2016-11-19 08:35:35 UTC 
Stable for HPPA PPC64.
Comment 5 Agostino Sarubbo gentoo-dev 2016-11-27 11:37:36 UTC 
arm stable
Comment 6 Agostino Sarubbo gentoo-dev 2016-11-27 11:40:39 UTC 
ppc stable
Comment 7 Mike Gilbert gentoo-dev 2016-11-28 02:13:23 UTC 
I revbumped pillow-3.4.2 to resolve a file collision (bug 600694).

Remaining archs should proceed with dev-python/pillow-3.4.2-r1 instead.
Comment 8 Agostino Sarubbo gentoo-dev 2016-11-28 09:35:53 UTC 
sparc stable
Comment 9 Agostino Sarubbo gentoo-dev 2016-11-28 09:39:06 UTC 
ia64 stable.

Maintainer(s), please cleanup.
Comment 10 Thomas Deutschmann (RETIRED) gentoo-dev 2016-11-29 01:09:07 UTC 
*** Bug 596356 has been marked as a duplicate of this bug. ***
Comment 11 GLSAMaker/CVETool Bot gentoo-dev 2016-12-31 14:26:16 UTC 
This issue was resolved and addressed in
 GLSA 201612-52 at https://security.gentoo.org/glsa/201612-52
by GLSA coordinator Thomas Deutschmann (whissi).
Comment 12 Thomas Deutschmann (RETIRED) gentoo-dev 2016-12-31 14:32:25 UTC 
Re-opening for cleanup.

@ Maintainer(s): Please either drop <dev-python/pillow-3.4.2-r1 or apply package masks indicating a security problem.
Comment 13 Mike Gilbert gentoo-dev 2017-01-01 02:59:32 UTC 
Cleanup done.