[Bug 2042522] New: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

List overview All Threads
Download

newer

older

[Bug 2042527] New: CVE-2022-22817...

[Bug 2059360] New: yarnpkg for...

bugzilla＠redhat.com

19 Jan 2022 19 Jan '22

10:26 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Bug ID: 2042522 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: bdettelb@redhat.com, cstratak@redhat.com, epel-packagers-sig@lists.fedoraproject.org, infra-sig@lists.fedoraproject.org, manisandro@gmail.com, miminar@redhat.com, orion@nwra.com, python-maint@redhat.com, python-sig@lists.fedoraproject.org, torsava@redhat.com Target Milestone: --- Classification: Other

path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.

References: https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1dae... https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagep...

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Show replies by date

bugzilla＠redhat.com

19 Jan 19 Jan

10:26 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2042523, 2042524, 2042525

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=2042523 [Bug 2042523] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2042524 [Bug 2042524] CVE-2022-22816 mingw-python-pillow: python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2042525 [Bug 2042525] CVE-2022-22816 python3-pillow: python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c [epel-7]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

10:26 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created mingw-python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 2042524]

Created python-pillow tracking bugs for this issue:

Affects: fedora-all [bug 2042523]

Created python3-pillow tracking bugs for this issue:

Affects: epel-7 [bug 2042525]

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

10:30 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2042533

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

30 Jan 30 Jan

11:52 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Sandipan Roy saroy@redhat.com changed:

What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |Pillow 9.0.0

--- Doc Text *updated* --- A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, which can lead to a Buffer Over-read and Improper Initialization. This flaw allows an attacker to unauthorized memory access that leads us to memory access errors, incorrect results or crashes,

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

11:53 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Sandipan Roy saroy@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

31 Jan 31 Jan

2:24 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Doc Text *updated* by RaTasha Tillery-Smith rtillery@redhat.com --- A flaw was found in python-pillow. The vulnerability occurs due to improper initialization of image paths, leading to a buffer over-read and improper initialization. This flaw allows an attacker to unauthorized memory access that causes memory access errors, incorrect results, or crashes.

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3 Feb 3 Feb

7:20 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug 2042522 depends on bug 2042523, which changed state.

Bug 2042523 Summary: CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2042523

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

7:20 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522 Bug 2042522 depends on bug 2042524, which changed state.

Bug 2042524 Summary: CVE-2022-22816 mingw-python-pillow: python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2042524

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

16 Feb 16 Feb

4:55 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Sandipan Roy saroy@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

22 Feb 22 Feb

9:46 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #7 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 7

Via RHSA-2022:0609 https://access.redhat.com/errata/RHSA-2022:0609

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

9:46 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

11:43 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #8 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 8

Via RHSA-2022:0643 https://access.redhat.com/errata/RHSA-2022:0643

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

11:43 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

24 Feb 24 Feb

3:35 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #9 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:0669 https://access.redhat.com/errata/RHSA-2022:0669

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3:35 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3:51 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #10 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:0665 https://access.redhat.com/errata/RHSA-2022:0665

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3:51 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3:51 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #11 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:

Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:0667 https://access.redhat.com/errata/RHSA-2022:0667

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

3:51 a.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

errata-xmlrpc errata-xmlrpc@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

2 Mar 2 Mar

6:20 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

--- Comment #12 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-22816

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

bugzilla＠redhat.com

6:20 p.m.

New subject: [Bug 2042522] CVE-2022-22816 python-pillow: buffer over-read during initialization of ImagePath.Path in path_getbbox() in path.c

https://bugzilla.redhat.com/show_bug.cgi?id=2042522

Product Security DevOps Team prodsec-dev@redhat.com changed:

-- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2042522

922

Age (days ago)

965

Last active (days ago)

epel-packagers-sig@lists.stg.fedoraproject.org

21 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com