On Mon, Feb 29, 2016 at 12:10:33PM -0800, Christopher Allan Webber wrote: > See: https://lwn.net/Articles/677914/ > > > Package : pillow > > CVE ID : CVE-2016-0740 CVE-2016-0775 CVE-2016-2533 > > > > Multiple security vulnerabilities have been found in Pillow, a Python > > imaging library, which may result in denial of service or the execution > > of arbitrary code if a malformed FLI, PCD or Tiff files is processed. > > > > For the oldstable distribution (wheezy), this problem has been fixed > > in version 1.1.7-4+deb7u2 of the python-imaging source package. > > > > For the stable distribution (jessie), this problem has been fixed in > > version 2.6.1-2+deb8u2. > > > > For the testing distribution (stretch), this problem has been fixed > > in version 3.1.1-1. > > > > For the unstable distribution (sid), this problem has been fixed in > > version 3.1.1-1. > > > > We recommend that you upgrade your pillow packages. > > > > Further information about Debian Security Advisories, how to apply > > these updates to your system and frequently asked questions can be > > found at: https://www.debian.org/security/ > > I'm trying to figure out where the patches for this are, but I can't > find them. I expected them to maybe be here, but I don't see them here:
I updated python-pillow to 3.1.1 with 16095d2729, fixing these issues. When I did that, CVE-2016-2533 wasn't named yet, but my understanding is that the update does address it: https://github.com/python-pillow/Pillow/commits/e5324bd3b4195d68d4a066b16d912fca30d3c4be Python2-pil *is* vulnerable. However, it seems to have no users in our source tree. Should we remove it?
