USN-4697-2 pillow vulnerabilities

USN-4697-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted...

USN-4697-1: Pillow vulnerabilities

It was discovered that Pillow incorrectly handled certain PCX image files. If a user or automated system were tricked into opening a specially-crafted PCX file, a remote attacker could possibly cause Pillow to crash, resulting in a denial of service. CVE-2020-35653 It was discovered that Pillow...

CVE-2020-35653

In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations...

memegen-desktop (>=0.0.1, <=0.1.1), moca (0.3.3) +1 more potentially affected by CVE-2020-35653 via pillow (3.3.1)

pillow PYPI version 3.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - memegen-desktop =0.0.1, =0.0.4.dev68, =0.0.5.dev3 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

aperture-cli (>=0.0.0.dev1, <=1.0.0), aperturelib (>=0.0.0.dev1, <=1.0.0) +27 more potentially affected by CVE-2020-35653 via pillow (5.0.0)

pillow PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aperture-cli =0.0.0.dev1, =0.0.0.dev1, =0.0.1.dev1, =0.0.2, =0.2.0, =0.1.2, =0.1.9, =0.1.0, =1.0.0, =0.7.0, =0.9.8, =1.0.1, =1.0.2.post2 and more...

ayab (0.9.0), distribusi (>=0.0.2, <=0.0.4) potentially affected by CVE-2020-35653 via pillow (4.1.0)

pillow PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - ayab 0.9.0 - distribusi =0.0.2, =0.0.4 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

django-badgify-lab (0.1.5), django-oscar (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-35653 via pillow (2.4.0)

pillow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-badgify-lab 0.1.5 - django-oscar =1.0.0, =1.0.2 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

stoqdrivers (2.0.1) potentially affected by CVE-2020-35653 via pillow (3.1.2)

pillow PYPI version 3.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - stoqdrivers 2.0.1 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2020-35653 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2020-35653 via pillow (3.4.2)

pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2020-35653 Sour...

blockies (0.0.1), demosys-py (>=0.1.2, <=0.3.12) +17 more potentially affected by CVE-2020-35653 via pillow (4.0.0)

pillow PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - blockies 0.0.1 - demosys-py =0.1.2, =0.0.2, =1.6.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.0.0, =0.1.0, =3.0.0 and more Source cves:...

sphinxmark (0.1.15) potentially affected by CVE-2020-35653 via pillow (3.4.1)

pillow PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - sphinxmark 0.1.15 Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

alphad3m (>=0.10.0.dev0, <=0.10.0.dev1), amazoncaptcha (>=0.0.9, <=0.3.9) +55 more potentially affected by CVE-2020-35653 via pillow (7.1.2)

pillow PYPI version 7.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - alphad3m =0.10.0.dev0, =0.0.9, =0.0.1, =1.2.0, =0.1.3, =2.0.0rc1, =0.0.1, =1.2.4, =0.1.0, =0.3.1, =0.0.1, =0.1.4, =2022.1.5, =2022.5.26 and more...

acapy-patched-old (0.5.6), agl-predict-endo-frame (0.1.1) +271 more potentially affected by CVE-2020-35653 via pillow (7.2.0)

pillow PYPI version 7.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - acapy-patched-old 0.5.6 - agl-predict-endo-frame 0.1.1 - ailab-lite =0.1.1, =0.0.2, =0.3.10, =0.1.0, =2020.1.0, =0.9.0, =0.9.0, =0.8.1, =0.8.1,...

adversarial-robustness-toolbox (1.2.0), aristote-malo (1.9.5) +79 more potentially affected by CVE-2020-35653 via pillow (7.0.0)

pillow PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - adversarial-robustness-toolbox 1.2.0 - aristote-malo 1.9.5 - auto-annotate =1.0.0, =1.0.2, =0.1.0.dev31, =1.0.1, =0.2.3, =0.0.1.25, =0.2.1, =0.0.2,...

aioload (0.4.0), amazoncaptcha (0.5.0) +79 more potentially affected by CVE-2020-35653 via pillow (>=8.0.0, <=8.0.1)

pillow PYPI version =8.0.0, =1.0.0, =0.0.1a1.dev5, =0.1.0, =0.1.7, =0.1.3, =1.37.0, =1.38.1 and more Source cves: CVE-2020-35653 Source advisory: OSV:PYSEC-2021-69...

altair-images (>=0.1.0, <=0.1.4), colorizexl (>=0.0.1, <=0.2.1) +13 more potentially affected by CVE-2020-35653 via pillow (7.1.1)

pillow PYPI version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - altair-images =0.1.0, =0.0.1, =0.0.5, =0.6.0.post3, =0.4.3, =0.6.18, =1.0.4, =0.0.95, =0.4.1.post1, =0.1.1, =0.0.1, =0.3.0, =1.3.0, =0.2.5, =0.2.6...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2020-35653 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

aceui (>=1.0.2, <=1.0.21), biseau (>=0.0.1, <=0.0.18) +23 more potentially affected by CVE-2020-35653 via pillow (5.3.0)

pillow PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aceui =1.0.2, =0.0.1, =0.1.0, =0.1.1, =0.1.0, =0.3.0, =0.2.0, =1.0.0a1, =0.7.0a1, =1.0.8, =1.0.10 - nider 0.5.0 - optimuspyspark 2.1.1 and more Sour...

2xh-leet (0.1.2), actfw-core (>=2.0.0a0, <=2.1.1) +92 more potentially affected by CVE-2020-35653 via pillow (5.4.1)

pillow PYPI version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 2xh-leet 0.1.2 - actfw-core =2.0.0a0, =0.1.0a7, =0.1.1, =2.0.0a0, =0.57.1b6141, =2.0.1, =0.4.0, =0.4.0, =0.0.2, =4.3.0, =2.17.0, =0.5.0, =2.0.0,...