Bug 19565

Summary:	python-pillow new integer overflow security issue
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	Philippe Makowski <makowski.mageia>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal
Version:	Cauldron
Target Milestone:	---
Hardware:	All
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/703122/
Whiteboard:
Source RPM:	python-pillow-3.2.0-1.mga6.src.rpm	CVE:
Status comment:

Description David Walser 2016-10-11 14:30:33 CEST

Fedora has issued an advisory on October 9:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZDQP2G6ZOSDZJDPQXQAWL7MIQLKJZJNK/

They fixed it in these commits:
http://pkgs.fedoraproject.org/cgit/rpms/python-pillow.git/commit/?h=f24&id=474ca6269f9db048405a920deec3a5b0d86c0c72
http://pkgs.fedoraproject.org/cgit/rpms/python-pillow.git/commit/?h=f24&id=3453e7982fc0f651480b19b738beeb620f8c800e

Comment 1 Philippe Makowski 2016-10-12 14:28:05 CEST

I will certainly ask for a freeze push to upstream 3.4.1

Comment 2 Philippe Makowski 2016-10-12 14:41:52 CEST

(In reply to Philippe Makowski from comment #1)
> I will certainly ask for a freeze push to upstream 3.4.1

asked

Comment 3 David Walser 2016-10-12 20:14:28 CEST

Fixed, thanks.

Resolution: (none) => FIXED
Status: NEW => RESOLVED