FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

Revision:  456406
Date:      2017-12-15
Time:      16:33:12Z
Committer: brd

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
6ea60e00-cf13-11e5-805c-5453ed2e2b49py-imaging, py-pillow -- Buffer overflow in FLI decoding code

The Pillow maintainers report:

In all versions of Pillow, dating back at least to the last PIL 1.1.7 release, FliDecode.c has a buffer overflow error.

There is a memcpy error where x is added to a target buffer address. X is used in several internal temporary variable roles, but can take a value up to the width of the image. Im->image[y] is a set of row pointers to segments of memory that are the size of the row. At the max y, this will write the contents of the line off the end of the memory buffer, causing a segfault.

This issue was found by Alyssa Besseling at Atlassian.


Discovery 2016-02-05
Entry 2016-02-09
py27-pillow
py33-pillow
py34-pillow
py35-pillow
lt 2.9.0_1

py27-imaging
lt 1.1.7_6

CVE-2016-0775
https://github.com/python-pillow/Pillow/commit/bcaaf97f4ff25b3b5b9e8efeda364e17e80858ec
a8de962a-cf15-11e5-805c-5453ed2e2b49py-imaging, py-pillow -- Buffer overflow in PCD decoder

The Pillow maintainers report:

In all versions of Pillow, dating back at least to the last PIL 1.1.7 release, PcdDecode.c has a buffer overflow error.

The state.buffer for PcdDecode.c is allocated based on a 3 bytes per pixel sizing, where PcdDecode.c wrote into the buffer assuming 4 bytes per pixel. This writes 768 bytes beyond the end of the buffer into other Python object storage. In some cases, this causes a segfault, in others an internal Python malloc error.


Discovery 2016-02-02
Entry 2016-02-09
py27-pillow
py33-pillow
py34-pillow
py35-pillow
lt 2.9.0_1

py27-imaging
lt 1.1.7_6

http://openwall.com/lists/oss-security/2016/02/02/5
https://github.com/python-pillow/Pillow/commit/ae453aa18b66af54e7ff716f4ccb33adca60afd4
https://github.com/python-pillow/Pillow/issues/568
53252879-cf11-11e5-805c-5453ed2e2b49py-pillow -- Buffer overflow in TIFF decoding code

The Pillow maintainers report:

Pillow 3.1.0 and earlier when linked against libtiff >= 4.0.0 on x64 may overflow a buffer when reading a specially crafted tiff file.

Specifically, libtiff >= 4.0.0 changed the return type of TIFFScanlineSize from int32 to machine dependent int32|64. If the scanline is sized so that it overflows an int32, it may be interpreted as a negative number, which will then pass the size check in TiffDecode.c line 236. To do this, the logical scanline size has to be > 2gb, and for the test file, the allocated buffer size is 64k against a roughly 4gb scan line size. Any image data over 64k is written over the heap, causing a segfault.

This issue was found by security researcher FourOne.


Discovery 2016-02-04
Entry 2016-02-09
py27-pillow
py33-pillow
py34-pillow
py35-pillow
lt 2.9.0_1

CVE-2016-0740
https://github.com/python-pillow/Pillow/commit/6dcbf5bd96b717c58d7b642949da8d323099928e
0519db18-cf15-11e5-805c-5453ed2e2b49py-pillow -- Integer overflow in Resample.c

The Pillow maintainers report:

If a large value was passed into the new size for an image, it is possible to overflow an int32 value passed into malloc, leading the malloc’d buffer to be undersized. These allocations are followed by a loop that writes out of bounds. This can lead to corruption on the heap of the Python process with attacker controlled float data.

This issue was found by Ned Williamson.


Discovery 2016-02-05
Entry 2016-02-09
py27-pillow
py33-pillow
py34-pillow
py35-pillow
lt 2.9.0_1

https://github.com/python-pillow/Pillow/commit/41fae6d9e2da741d2c5464775c7f1a609ea03798
https://github.com/python-pillow/Pillow/issues/1710
bc4898d5-a794-11e6-b2d3-60a44ce6887bPillow -- multiple vulnerabilities

Pillow reports:

Pillow prior to 3.3.2 may experience integer overflow errors in map.c when reading specially crafted image files. This may lead to memory disclosure or corruption.

Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check for negative image sizes in ImagingNew in Storage.c. A negative image size can lead to a smaller allocation than expected, leading to arbi trary writes.


Discovery 2016-09-06
Entry 2016-12-04
py27-pillow
py33-pillow
py34-pillow
py35-pillow
lt 3.3.2

http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html
https://github.com/python-pillow/Pillow/issues/2105
CVE-2016-9189
CVE-2016-9190
ports/214410