[debbugs-tracker] bug#22858: closed (Patch security vulnerability in python-pillow)

[GNU bug Tracking System]

Your message dated Mon, 29 Feb 2016 15:04:04 -0800
with message-id <address@hidden>
and subject line Re: bug#22858: Patch security vulnerability in python-pillow
has caused the debbugs.gnu.org bug report #22858,
regarding Patch security vulnerability in python-pillow
to be marked as done.

(If you believe you have received this mail in error, please contact
address@hidden)


-- 
22858: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22858
GNU Bug Tracking System
Contact address@hidden with problems
> --- Begin Message ---
>
>
>
> Subject: 
>
> Patch security vulnerability in python-pillow
>
>
>
>
> Date: 
>
> Mon, 29 Feb 2016 12:10:33 -0800
>
>
>
>
> User-agent: 
>
> mu4e 0.9.13; emacs 24.5.1
>
>
>
>
> See: https://lwn.net/Articles/677914/
>
> > Package        : pillow
> > CVE ID         : CVE-2016-0740 CVE-2016-0775 CVE-2016-2533 
> > 
> > Multiple security vulnerabilities have been found in Pillow, a Python
> > imaging library, which may result in denial of service or the execution
> > of arbitrary code if a malformed FLI, PCD or Tiff files is processed.
> > 
> > For the oldstable distribution (wheezy), this problem has been fixed
> > in version 1.1.7-4+deb7u2 of the python-imaging source package.
> > 
> > For the stable distribution (jessie), this problem has been fixed in
> > version 2.6.1-2+deb8u2.
> > 
> > For the testing distribution (stretch), this problem has been fixed
> > in version 3.1.1-1.
> > 
> > For the unstable distribution (sid), this problem has been fixed in
> > version 3.1.1-1.
> > 
> > We recommend that you upgrade your pillow packages.
> > 
> > Further information about Debian Security Advisories, how to apply
> > these updates to your system and frequently asked questions can be
> > found at: https://www.debian.org/security/
>
> I'm trying to figure out where the patches for this are, but I can't
> find them.  I expected them to maybe be here, but I don't see them here:
>
>   http://sources.debian.net/patches/pillow/3.1.1-1/
>
>
>
> --- End Message ---
> --- Begin Message ---
>
>
>
> Subject: 
>
> Re: bug#22858: Patch security vulnerability in python-pillow
>
>
>
>
> Date: 
>
> Mon, 29 Feb 2016 15:04:04 -0800
>
>
>
>
> User-agent: 
>
> mu4e 0.9.13; emacs 24.5.1
>
>
>
>
> Christopher Allan Webber writes:
>
> > Leo Famulari writes:
> >
> >>> I'm trying to figure out where the patches for this are, but I can't
> >>> find them.  I expected them to maybe be here, but I don't see them here:
> >>
> >> I updated python-pillow to 3.1.1 with 16095d2729, fixing these issues.
> >>
> >> When I did that, CVE-2016-2533 wasn't named yet, but my understanding is
> >> that the update does address it:
> >> https://github.com/python-pillow/Pillow/commits/e5324bd3b4195d68d4a066b16d912fca30d3c4be
> >>
> >> Python2-pil *is* vulnerable. However, it seems to have no users in our
> >> source tree. Should we remove it?
> >
> > I think so.  Here's a patch to remove it.  Look good?  (Not sure if this
> > needs a review or not :))
> >
> >  - Chris
>
> Leo gave me some comments on the description on IRC, so I changed those
> and pushed!
>
>
> --- End Message ---