Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2021-2564)

The remote host is missing an update for the Huawei EulerOS 'python-pillow' package(s) announced via the EulerOS-SA-2021-2564 advisory.

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.(CVE-2021-34552) An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.(CVE-2021-25291) An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.(CVE-2021-25289) An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.(CVE-2021-25292) An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.(CVE-2021-25293)

'python-pillow' package(s) on Huawei EulerOS V2.0SP9(x86_64).

Checks if a vulnerable package version is present on the target host.

Please install the updated package(s).