View | Details | Raw Unified | Return to bug 214410
Collapse All | Expand All

(-)security/vuxml/vuln.xml (+29 lines)
Lines 58-63 Link Here
58
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
58
  * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
59
-->
59
-->
60
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
60
<vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
61
  <vuln vid="bc4898d5-a794-11e6-b2d3-60a44ce6887b">
62
    <topic>Pillow -- multiple vulnerabilities</topic>
63
    <affects>
64
      <package>
65
	<name>py-pillow</name>
66
	<range><lt>3.3.2</lt></range>
67
      </package>
68
    </affects>
69
    <description>
70
      <body xmlns="http://www.w3.org/1999/xhtml">
71
	<p>Pillow reports:</p>
72
	<blockquote cite="http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html">
73
	  <p>Pillow prior to 3.3.2 may experience integer overflow errors in map.c when reading specially crafted image files. This may lead to memory disclosure or corruption.</p>
74
	  <p>Pillow prior to 3.3.2 and PIL 1.1.7 (at least) do not check for negative image sizes in ImagingNew in Storage.c. A negative image size can lead to a smaller allocation than expected, leading to arbitrary writes.</p>
75
	</blockquote>
76
      </body>
77
    </description>
78
    <references>
79
	<url>http://pillow.readthedocs.io/en/3.4.x/releasenotes/3.3.2.html</url>
80
	<url>https://github.com/python-pillow/Pillow/issues/2105</url>
81
	<cvename>CVE-2016-9189</cvename>
82
	<cvename>CVE-2016-9190</cvename>
83
    </references>
84
    <dates>
85
      <discovery>2016-09-06</discovery>
86
      <entry>2016-11-10</entry>
87
    </dates>
88
  </vuln>
89
61
  <vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
90
  <vuln vid="50751310-a763-11e6-a881-b499baebfeaf">
62
    <topic>openssl -- multiple vulnerabilities</topic>
91
    <topic>openssl -- multiple vulnerabilities</topic>
63
    <affects>
92
    <affects>

Return to bug 214410