USN-6744-3: Pillow vulnerability
USN-6744-1 fixed a vulnerability in Pillow. This update provides the corresponding updates for Ubuntu 24.04 LTS. Original advisory details: Hugo van Kemenade discovered that Pillow was not properly performing bounds checks when processing an ICC file, which could lead to a buffer overflow. If a user or automated system were tricked into processing a specially crafted ICC file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6744-3?
USN-6744-3 addresses a critical vulnerability in the Pillow library that could compromise the security of affected systems.
How do I fix USN-6744-3?
To resolve USN-6744-3, upgrade the python3-pil package to version 10.2.0-1ubuntu1 or later on Ubuntu 24.04 LTS.
Which systems are affected by USN-6744-3?
USN-6744-3 affects Ubuntu 24.04 LTS systems running vulnerable versions of the Pillow library.
What is the nature of the vulnerability in USN-6744-3?
The vulnerability in USN-6744-3 is related to improper bounds checking when processing ICC files in the Pillow library.
Is there any known exploit for USN-6744-3?
As of now, details on specific exploits for USN-6744-3 have not been disclosed, but the vulnerability poses serious risks if unpatched.