19565 – python-pillow new integer overflow security issue

Bug 19565 - python-pillow new integer overflow security issue

Summary: python-pillow new integer overflow security issue

Status:	RESOLVED FIXED

Alias:	None

Product:	Mageia
Classification:	Unclassified
Component:	Security (show other bugs)
Version:	Cauldron
Hardware:	All Linux

Priority:	Normal Severity: normal
Target Milestone:	---
Assignee:	Philippe Makowski
QA Contact:	Sec team

URL:	http://lwn.net/Vulnerabilities/703122/
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2016-10-11 14:30 CEST by David Walser
Modified:	2016-10-12 20:14 CEST (History)
CC List:	0 users

See Also:
Source RPM:	python-pillow-3.2.0-1.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2016-10-11 14:30:33 CEST

Fedora has issued an advisory on October 9:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/ZDQP2G6ZOSDZJDPQXQAWL7MIQLKJZJNK/

They fixed it in these commits:
http://pkgs.fedoraproject.org/cgit/rpms/python-pillow.git/commit/?h=f24&id=474ca6269f9db048405a920deec3a5b0d86c0c72
http://pkgs.fedoraproject.org/cgit/rpms/python-pillow.git/commit/?h=f24&id=3453e7982fc0f651480b19b738beeb620f8c800e

Comment 1 Philippe Makowski 2016-10-12 14:28:05 CEST

I will certainly ask for a freeze push to upstream 3.4.1

Comment 2 Philippe Makowski 2016-10-12 14:41:52 CEST

(In reply to Philippe Makowski from comment #1)
> I will certainly ask for a freeze push to upstream 3.4.1

asked

Comment 3 David Walser 2016-10-12 20:14:28 CEST

Fixed, thanks.

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Note You need to log in before you can comment on or make changes to this bug.