Advisories » MGASA-2015-0039

Updated python-pillow packages fix CVE-2014-9601

Publication date: 27 Jan 2015
Modification date: 27 Jan 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-9601

Description

Updated python-pillow packages fix security vulnerability:

Pillow before 2.7.0 and 2.6.2 allows remote attackers to cause a denial of
service via a compressed text chunk in a PNG image that has a large size when
it is decompressed (CVE-2014-9601).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=15115
• https://github.com/python-pillow/Pillow/blob/master/CHANGES.rst
• https://lists.fedoraproject.org/pipermail/package-announce/2015-January/148442.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601

SRPMS

4/core

• python-pillow-2.6.2-1.1.mga4