[USN-6618-1] Pillow vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmW5MDcACgkQZWnYVadE
vpMskA//e/QCBSfmYiGaCcGA9Xvjg0JNdEyZ+UnMltZlP4UI50mCaQEnFbOzolra
wjUbovLiLPsrHfwg2vhJl2Ms3SI+FBoUv+iYTs5KMm9OimCfxl1jOakeAUhlxYds
7pg6Gs7lM6h6uXjAuJ/ufFsjUY3OcpZ6YTkHbkZyd3fr52ka8mK+x5J4YAP72hAl
1vCSmqWRsDpVCZDpA8VrcaR7g4z4VMRudEIMaA4b/Z1AeR+V0FxLD3eEQEPC4mi4
yt6ztptpo3hhyOIP60pZkbS4hOpV/hKtvQuoXAu5KY38tMZEuCuql9gYe6gHkRtp
l6DRXPyEwW8/4lKzbkHyhp3tLqnlbUlrU06RutcisUszeGWBqDS1pWfwQXho8oiP
xC4Ti7Q786NEBs4F8wmXxpF9frDMGje2tcZLIfww/5Z6vNbd5s2A0wKwt1Hr/6fD
ILKgI1t+X4g8Ny0kxRj6q73bGcX2MqyrZWzqMwT+wkDGGelLTNW0NEqTp3NNljYO
SFlSIwa6L3nZ8HxVjNpDUczGCor5kFS1e7UZdgu3x/vBmSqG2ChQHvBg8L6wGOxH
PcUz0IBDAZZVKoNy8wFDwh5nrxzMdhF+XYU6NQ5Nz9i/2fMzvYeFCX51z4mw19z1
2b/cjLyPPmPxq10YSGheztzgUd4+evl7W3h+RwdYVmz+0V3mRrQ=
=n3T0
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6618-1
January 30, 2024

pillow vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Pillow.

Software Description:
- pillow: Python Imaging Library

Details:

It was discovered that Pillow incorrectly handled certain long text
arguments. An attacker could possibly use this issue to cause Pillow to
consume resources, leading to a denial of service. This issue only affected
Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271)

Duarte Santos discovered that Pillow incorrectly handled the environment
parameter to PIL.ImageMath.eval. An attacker could possibly use this issue
to execute arbitrary code. (CVE-2023-50447)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
python3-pil 10.0.0-1ubuntu0.1

Ubuntu 22.04 LTS:
python3-pil 9.0.1-1ubuntu0.2

Ubuntu 20.04 LTS:
python3-pil 7.0.0-4ubuntu0.8

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6618-1
CVE-2023-44271, CVE-2023-50447

Package Information:
https://launchpad.net/ubuntu/+source/pillow/10.0.0-1ubuntu0.1
https://launchpad.net/ubuntu/+source/pillow/9.0.1-1ubuntu0.2
https://launchpad.net/ubuntu/+source/pillow/7.0.0-4ubuntu0.8