Ubuntu Security Notice 6744-2 - USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Pillow in Ubuntu 20.04 LTS. Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
7f9a3f70c1f7e100375a7fbb89547638e45380d3ba57eca5212263547b378f8c
==========================================================================
Ubuntu Security Notice USN-6744-2
April 22, 2024
pillow vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS (Available with Ubuntu Pro)
Summary:
Pillow could be made to crash or run programs as an administrator
if it opened a specially crafted file.
Software Description:
- pillow-python2: Python Imaging Library (Pillow fork)
Details:
USN-6744-1 fixed a vulnerability in Pillow (Python 3). This update
provides the corresponding updates for Pillow (Python 2) in
Ubuntu 20.04 LTS.
Original advisory details:
Hugo van Kemenade discovered that Pillow was not properly performing
bounds checks when processing an ICC file, which could lead to a buffer
overflow. If a user or automated system were tricked into processing a
specially crafted ICC file, an attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS (Available with Ubuntu Pro):
python-pil 6.2.1-3ubuntu0.1~esm2
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6744-2
https://ubuntu.com/security/notices/USN-6744-1
CVE-2024-28219