{"affected":[{"ecosystem_specific":{"binaries":[{"python-Pillow":"2.8.1-4.22.1"}]},"package":{"ecosystem":"SUSE:OpenStack Cloud 7","name":"python-Pillow","purl":"purl:rpm/suse/python-Pillow&distro=SUSE%20OpenStack%20Cloud%207"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.8.1-4.22.1"}],"type":"ECOSYSTEM"}]}],"aliases":[],"details":"This update for python-Pillow fixes the following issues:\n\n- CVE-2021-25290: Fixed a negative-offset memcpy with an invalid size in TiffDecode.c (bsc#1183105).\n- CVE-2021-27922,CVE-2021-27923: Fixed improper reported size of a contained image (bsc#1183108,bsc#1183107)  \n- CVE-2020-35653: Fixed buffer over-read in PcxDecode when decoding a crafted PCX file (bsc#1180834).\n- CVE-2021-25287: Fixed out-of-bounds read in J2kDecode in j2ku_graya_la (bsc#1185805).\n- CVE-2021-25288: Fixed out-of-bounds read in J2kDecode in j2ku_gray_i (bsc#1185803).\n- CVE-2021-28675: Fixed DoS in PsdImagePlugin (bsc#1185804).\n- CVE-2021-28677: Fixed DoS in the open phase via a malicious EPS file (bsc#1185785).\n- CVE-2021-28676: Fixed infinite loop in FliDecode.c (bsc#1185786).\n","id":"SUSE-SU-2021:1940-1","modified":"2021-06-10T08:49:31Z","published":"2021-06-10T08:49:31Z","references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211940-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1180834"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183105"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183107"},{"type":"REPORT","url":"https://bugzilla.suse.com/1183108"},{"type":"REPORT","url":"https://bugzilla.suse.com/1185785"},{"type":"REPORT","url":"https://bugzilla.suse.com/1185786"},{"type":"REPORT","url":"https://bugzilla.suse.com/1185803"},{"type":"REPORT","url":"https://bugzilla.suse.com/1185804"},{"type":"REPORT","url":"https://bugzilla.suse.com/1185805"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-35653"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-25287"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-25288"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-25290"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-27922"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-27923"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-28675"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-28676"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-28677"}],"related":["CVE-2020-35653","CVE-2021-25287","CVE-2021-25288","CVE-2021-25290","CVE-2021-27922","CVE-2021-27923","CVE-2021-28675","CVE-2021-28676","CVE-2021-28677"],"summary":"Security update for python-Pillow"}