USN-6618-1: Pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain long text arguments. An attacker could possibly use this issue to cause Pillow to consume resources, leading to a denial of service. This issue only affected Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2023-44271) Duarte Santos discovered that Pillow incorrectly handled the environment parameter to PIL.ImageMath.eval. An attacker could possibly use this issue to execute arbitrary code. (CVE-2023-50447)
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6618-1?
The severity of USN-6618-1 is regarded as high due to the potential for denial of service through resource exhaustion.
How do I fix USN-6618-1?
To fix USN-6618-1, users should upgrade the python3-pil package to the recommended version depending on their Ubuntu release.
Which versions of Ubuntu are affected by USN-6618-1?
USN-6618-1 affects Ubuntu 20.04 LTS and Ubuntu 22.04 LTS due to vulnerabilities in the python3-pil package.
What specific package is vulnerable in USN-6618-1?
The specific vulnerable package in USN-6618-1 is python3-pil, which has issues handling long text arguments.
What can an attacker achieve with USN-6618-1?
An attacker can exploit USN-6618-1 to leverage resource consumption vulnerabilities in Pillow, potentially causing a denial of service.