Bug 13916 - python-pillow and python-imaging new security issue CVE-2014-3589
Summary: python-pillow and python-imaging new security issue CVE-2014-3589
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/609186/
Whiteboard: MGA3TOO has_procedure advisory MGA4-6...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2014-08-16 00:01 CEST by David Walser
Modified: 2014-08-21 20:00 CEST (History)
2 users (show)

See Also:
Source RPM: python-pillow-2.2.1-0.4.mga4.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2014-08-16 00:01:49 CEST 
Upstream has released version 2.3.2 on August 13 to fix a security issue:
https://pypi.python.org/pypi/Pillow/2.3.2

Philippe updated the package to version 2.3.2 in Cauldron.

The upstream patch commit to fix this is here:
https://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d

Patched packages uploaded for Mageia 3 (python-imaging) and Mageia 4 (python-pillow).

Advisory:
========================

Updated python-imaging and python-pillow packages fix security vulnerabilities:

The Python Imaging Library is vulnerable to a denial of service attack in the
IcnsImagePlugin (CVE-2014-3589).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589
https://pypi.python.org/pypi/Pillow/2.3.2
========================

Updated packages in core/updates_testing:
========================
python-imaging-1.1.7-7.2.mga3
python-imaging-devel-1.1.7-7.2.mga3
python-pillow-2.2.1-0.5.mga4
python-pillow-devel-2.2.1-0.5.mga4
python-pillow-doc-2.2.1-0.5.mga4
python-pillow-sane-2.2.1-0.5.mga4
python-pillow-tk-2.2.1-0.5.mga4
python-pillow-qt-2.2.1-0.5.mga4
python3-pillow-2.2.1-0.5.mga4
python3-pillow-devel-2.2.1-0.5.mga4
python3-pillow-doc-2.2.1-0.5.mga4
python3-pillow-sane-2.2.1-0.5.mga4
python3-pillow-tk-2.2.1-0.5.mga4
python3-pillow-qt-2.2.1-0.5.mga4

from SRPMS:
python-imaging-1.1.7-7.2.mga3.src.rpm
python-pillow-2.2.1-0.5.mga4.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2014-08-16 00:01:54 CEST

Whiteboard: (none) => MGA3TOO

Comment 1 David Walser 2014-08-16 00:02:28 CEST 
Testing procedure:
https://bugs.mageia.org/show_bug.cgi?id=13075#c1

Whiteboard: MGA3TOO => MGA3TOO has_procedure

Comment 2 Rémi Verschelde 2014-08-19 19:31:18 CEST 
Testing complete on Mageia 4 64bit.

CC: (none) => remi
Whiteboard: MGA3TOO has_procedure => MGA3TOO has_procedure MGA4-64-OK

Comment 3 claire robinson 2014-08-20 16:35:03 CEST 
Testing complete mga3 32

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO has_procedure MGA4-64-OK => MGA3TOO has_procedure advisory MGA4-64-OK mga3-32-ok
CC: (none) => sysadmin-bugs

Comment 4 Mageia Robot 2014-08-21 11:37:13 CEST 
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0343.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

David Walser 2014-08-21 20:00:56 CEST

URL: (none) => http://lwn.net/Vulnerabilities/609186/
Note You need to log in before you can comment on or make changes to this bug.