Upstream bug: https://github.com/python-pillow/Pillow/pull/5377 From release notes (https://github.com/python-pillow/Pillow/pull/5377/commits/8ec027867f19633d9adfc5c8b7504d9b609fc5f1): These were all found with `OSS-Fuzz`_. :cve:`CVE-2021-25287`, :cve:`CVE-2021-25288`: Fix OOB read in Jpeg2KDecode ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * For J2k images with multiple bands, it's legal to have different widths for each band, e.g. 1 byte for ``L``, 4 bytes for ``A``. * This dates to Pillow 2.4.0. :cve:`CVE-2021-28675`: Fix DOS in PsdImagePlugin ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * :py:class:`.PsdImagePlugin.PsdImageFile` did not sanity check the number of input layers with regard to the size of the data block, this could lead to a denial-of-service on :py:meth:`~PIL.Image.open` prior to :py:meth:`~PIL.Image.Image.load`. * This dates to the PIL fork. :cve:`CVE-2021-28676`: Fix FLI DOS ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * ``FliDecode.c`` did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load. * This dates to the PIL fork. :cve:`CVE-2021-28677`: Fix EPS DOS on _open ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * The readline used in EPS has to deal with any combination of ``\r`` and ``\n`` as line endings. It accidentally used a quadratic method of accumulating lines while looking for a line ending. * A malicious EPS file could use this to perform a denial-of-service of Pillow in the open phase, before an image was accepted for opening. * This dates to the PIL fork. :cve:`CVE-2021-28678`: Fix BLP DOS ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ * ``BlpImagePlugin`` did not properly check that reads after jumping to file offsets returned data. This could lead to a denial-of-service where the decoder could be run a large number of times on empty data. * This dates to Pillow 5.1.0. Fix memory DOS in ImageFont ^^^^^^^^^^^^^^^^^^^^^^^^^^^ * A corrupt or specially crafted TTF font could have font metrics that lead to unreasonably large sizes when rendering text in font. ``ImageFont.py`` did not check the image size before allocating memory for it. * This dates to the PIL fork.
x86 done
amd64 done
sparc stable
ppc done
ppc64 done
arm64 done
arm done all arches done
Cleanup already done.
GLSA request filed.
This issue was resolved and addressed in GLSA 202107-33 at https://security.gentoo.org/glsa/202107-33 by GLSA coordinator John Helmert III (ajak).
