https://bugzilla.redhat.com/show_bug.cgi?id=2042527
Bug ID: 2042527
Summary: CVE-2022-22817 python-pillow: PIL.ImageMath.eval
allows evaluation of arbitrary expressions
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bdettelb(a)redhat.com, cstratak(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
infra-sig(a)lists.fedoraproject.org,
manisandro(a)gmail.com, miminar(a)redhat.com,
orion(a)nwra.com, python-maint(a)redhat.com,
python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com
Target Milestone: ---
Classification: Other
PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary
expressions, such as ones that use the Python exec method.
Reference:
https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-bu…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2042527
https://bugzilla.redhat.com/show_bug.cgi?id=2042522
Bug ID: 2042522
Summary: CVE-2022-22816 python-pillow: buffer over-read during
initialization of ImagePath.Path in path_getbbox() in
path.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: high
Priority: high
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bdettelb(a)redhat.com, cstratak(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
infra-sig(a)lists.fedoraproject.org,
manisandro(a)gmail.com, miminar(a)redhat.com,
orion(a)nwra.com, python-maint(a)redhat.com,
python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com
Target Milestone: ---
Classification: Other
path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during
initialization of ImagePath.Path.
References:
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da…https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2042522
https://bugzilla.redhat.com/show_bug.cgi?id=2042511
Bug ID: 2042511
Summary: CVE-2022-22815 python-pillow: improperly initializes
ImagePath.Path in path_getbbox() in path.c
Product: Security Response
Hardware: All
OS: Linux
Status: NEW
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: gsuckevi(a)redhat.com
CC: bdettelb(a)redhat.com, cstratak(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
infra-sig(a)lists.fedoraproject.org,
manisandro(a)gmail.com, miminar(a)redhat.com,
orion(a)nwra.com, python-maint(a)redhat.com,
python-sig(a)lists.fedoraproject.org, torsava(a)redhat.com
Target Milestone: ---
Classification: Other
path_getbbox in path.c in Pillow before 9.0.0 improperly initializes
ImagePath.Path.
References:
https://github.com/python-pillow/Pillow/blob/c5d9223a8b5e9295d15b5a9b1ef1da…https://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-image…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2042511
https://bugzilla.redhat.com/show_bug.cgi?id=2176591
Bug ID: 2176591
Summary: msmtp package should provide /usr/bin/sendmail
Product: Fedora
Version: rawhide
Status: NEW
Component: msmtp
Assignee: lemenkov(a)gmail.com
Reporter: yann(a)droneaud.fr
QA Contact: extras-qa(a)fedoraproject.org
CC: epel-packagers-sig(a)lists.fedoraproject.org,
gbcox(a)bzb.us, lemenkov(a)gmail.com, ndevos(a)redhat.com,
wart(a)kobold.org
Target Milestone: ---
Classification: Fedora
Description of problem:
msmtp package is not declared to provide /usr/sbin/sendmail. But installing
the package, makes msmtp the "mta" (see alternatives --display mta), and thus
provide /usr/bin/sendmail.
Some packages, see below, requires /usr/sbin/sendmail
BackupPC-0:4.4.0-9.fc38.x86_64
alpine-0:2.26-3.fc38.x86_64
arpwatch-14:3.3-14.fc39.x86_64
asterisk-voicemail-0:18.12.1-1.fc38.3.x86_64
certwatch-mod_ssl-0:1.2-12.fc38.x86_64
fail2ban-sendmail-0:1.0.2-2.fc38.noarch
fvwm-0:2.7.0-3.fc38.x86_64
hylafax+-client-0:7.0.7-1.fc39.i686
hylafax+-client-0:7.0.7-1.fc39.x86_64
mgetty-0:1.2.1-18.fc38.x86_64
quilt-0:0.67-4.fc39.noarch
redhat-lsb-core-0:4.1-60.fc38.i686
redhat-lsb-core-0:4.1-60.fc38.x86_64
spamass-milter-0:0.4.0-24.fc38.x86_64
uudeview-0:0.5.20-51.fc38.x86_64
websec-0:1.9.0-34.fc38.noarch
x509watch-0:0.6.1-14.fc38.noarch
Thus, when asking dnf to install one of the packages above, it will also
install another mta from the list below if none of them is already installed.
Likely esmtp in my experience (likely because it's the first alphabetically).
esmtp-0:1.2-21.fc38.x86_64
exim-0:4.96-8.fc38.x86_64
opensmtpd-0:6.8.0p2-11.fc38.x86_64
postfix-2:3.7.4-1.fc38.x86_64
sendmail-0:8.17.1-8.fc38.x86_64
ssmtp-0:2.64-32.fc38.x86_64
Having msmtp already installed should be enough to satisfy /usr/sbin/sendmail
requirement, and no other MTA should be installed as part of installing another
package.
Version-Release number of selected component (if applicable):
msmtp-1.8.23-1.fc38.x86_64
How reproducible:
When installing a package that requires /usr/bin/sendmail when no other MTA
is installed.
Steps to Reproduce:
1. dnf install msmtp
2. dnf install arpwatch
Actual results:
"dnf install arpwatch" installs arpwatch and esmtp
Expected results:
"dnf install arpwatch" would install only arpwatch
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2176591
https://bugzilla.redhat.com/show_bug.cgi?id=2208403
Bug ID: 2208403
Summary: busybox-1.36.1 is available
Product: Fedora
Version: rawhide
Status: NEW
Component: busybox
Keywords: FutureFeature, Triaged
Assignee: spotrh(a)gmail.com
Reporter: upstream-release-monitoring(a)fedoraproject.org
QA Contact: extras-qa(a)fedoraproject.org
CC: admiller(a)redhat.com, davide(a)cavalca.name,
dvlasenk(a)redhat.com,
epel-packagers-sig(a)lists.fedoraproject.org,
spotrh(a)gmail.com
Target Milestone: ---
Classification: Fedora
Releases retrieved: 1.36.1
Upstream release that is considered latest: 1.36.1
Current version/release in rawhide: 1.36.0-2.fc38
URL: https://www.busybox.net/
Please consult the package updates policy before you issue an update to a
stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/
More information about the service that created this bug can be found at:
https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M…
Please keep in mind that with any upstream change, there may also be packaging
changes that need to be made. Specifically, please remember that it is your
responsibility to review the new version to ensure that the licensing is still
correct and that no non-free or legally problematic items have been added
upstream.
Based on the information from Anitya:
https://release-monitoring.org/project/230/
To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/busybox
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2208403
https://bugzilla.redhat.com/show_bug.cgi?id=2224596
Bug ID: 2224596
Summary: [abrt] meld: gtk_text_iter_make_real(): python3.11
killed by SIGSEGV
Product: Fedora
Version: 38
Hardware: x86_64
Status: NEW
Whiteboard: abrt_hash:b51bbb220c5fd5e5b35c730bf49f76df5fb0ae98;VAR
IANT_ID=workstation;
Component: meld
Assignee: dmaphy(a)fedoraproject.org
Reporter: michael.scheiffler(a)pdts.at
QA Contact: extras-qa(a)fedoraproject.org
CC: dmaphy(a)fedoraproject.org,
epel-packagers-sig(a)lists.fedoraproject.org,
lkundrak(a)v3.sk, michel(a)michel-slm.name
Target Milestone: ---
Classification: Fedora
Description of problem:
Performing search in meld
Version-Release number of selected component:
meld-3.22.0-2.fc38
Additional info:
reporter: libreport-2.17.11
type: CCpp
reason: python3.11 killed by SIGSEGV
journald_cursor:
s=775391bc4c1d4c2db8240bca711a394d;i=19a026;b=b1b68f8475924c1bbbdc47dbfbee0935;m=32ee0eae1;t=60100eb1567fa;x=2f6ce569d2876fdc
executable: /usr/bin/python3.11
cmdline: /usr/bin/python3 /usr/bin/meld kernel-6.2.16.spec kernel.spec
cgroup:
0::/user.slice/user-1000.slice/user@1000.service/app.slice/vte-spawn-4169a221-16ac-4ae9-b6ca-50974efb585e.scope
rootdir: /
uid: 1000
kernel: 6.2.16-300.fc38.x86_64
package: meld-3.22.0-2.fc38
runlevel: N 5
backtrace_rating: 4
crash_function: gtk_text_iter_make_real
comment: Performing search in meld
Truncated backtrace:
Thread no. 1 (55 frames)
#0 gtk_text_iter_make_real at ../gtk/gtktextiter.c:214
#1 gtk_text_iter_get_char at ../gtk/gtktextiter.c:868
#2 gtk_text_iter_ends_line at ../gtk/gtktextiter.c:1583
#3 adjust_subregion at ../gtksourceview/gtksourcesearchcontext.c:1273
#4 scan_subregion at ../gtksourceview/gtksourcesearchcontext.c:1528
#5 scan_region_forward at ../gtksourceview/gtksourcesearchcontext.c:1644
#6 smart_forward_search_step at ../gtksourceview/gtksourcesearchcontext.c:2150
#7 smart_forward_search at ../gtksourceview/gtksourcesearchcontext.c:2178
#8 gtk_source_search_context_forward at
../gtksourceview/gtksourcesearchcontext.c:3248
#9 ffi_call_unix64 at ../src/x86/unix64.S:104
#10 ffi_call_int at ../src/x86/ffi64.c:673
#11 ffi_call at ../src/x86/ffi64.c:710
#12 pygi_invoke_c_callable at ../gi/pygi-invoke.c:684
#13 pygi_function_cache_invoke at ../gi/pygi-cache.c:862
#14 pygi_callable_info_invoke at ../gi/pygi-invoke.c:727
#15 _wrap_g_callable_info_invoke at ../gi/pygi-invoke.c:764
#16 _callable_info_call at ../gi/pygi-info.c:548
#17 _PyObject_MakeTpCall at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Objects/call.c:214
#18 _PyEval_EvalFrameDefault at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/ceval.c:4774
#19 _PyEval_EvalFrame at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Include/internal/pycore_ceval.h:73
#20 _PyEval_Vector at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/ceval.c:6439
#21 _PyFunction_Vectorcall at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Objects/call.c:393
#22 _PyObject_VectorcallTstate at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Include/internal/pycore_call.h:92
#23 method_vectorcall at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Objects/classobject.c:89
#24 pygi_signal_closure_marshal at ../gi/pygi-signal-closure.c:197
#26 signal_emit_unlocked_R.isra.0 at ../gobject/gsignal.c:3812
#29 gtk_search_entry_changed_timeout_cb at ../gtk/gtksearchentry.c:295
#33 g_main_context_iterate.isra.0 at ../glib/gmain.c:4276
#34 g_main_context_iteration at ../glib/gmain.c:4343
#35 g_application_run at ../gio/gapplication.c:2573
#36 ffi_call_unix64 at ../src/x86/unix64.S:104
#37 ffi_call_int at ../src/x86/ffi64.c:673
#38 ffi_call at ../src/x86/ffi64.c:710
#39 pygi_invoke_c_callable at ../gi/pygi-invoke.c:684
#40 pygi_function_cache_invoke at ../gi/pygi-cache.c:862
#41 pygi_callable_info_invoke at ../gi/pygi-invoke.c:727
#42 _wrap_g_callable_info_invoke at ../gi/pygi-invoke.c:764
#43 _PyObject_Call at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Objects/call.c:343
#44 _PyEval_EvalFrameDefault at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/ceval.c:5381
#45 _PyEval_EvalFrame at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Include/internal/pycore_ceval.h:73
#46 _PyEval_Vector at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/ceval.c:6439
#47 PyEval_EvalCode at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/ceval.c:1154
#48 run_eval_code_obj at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/pythonrun.c:1714
#49 run_mod at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/pythonrun.c:1735
#50 pyrun_file at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/pythonrun.c:1630
#51 _PyRun_SimpleFileObject at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/pythonrun.c:440
#52 _PyRun_AnyFileObject at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Python/pythonrun.c:79
#53 pymain_run_file_obj at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Modules/main.c:360
#54 pymain_run_file at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Modules/main.c:379
#55 pymain_run_python at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Modules/main.c:601
#56 Py_RunMain at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Modules/main.c:680
#57 Py_BytesMain at
/usr/src/debug/python3.11-3.11.4-1.fc38.x86_64/Modules/main.c:734
#58 __libc_start_call_main at ../sysdeps/nptl/libc_start_call_main.h:58
#59 __libc_start_main_impl at ../csu/libc-start.c:360
#60 _start
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2224596
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…