There is an out-of-bounds read in J2kDecode in j2ku_graya_la. For J2k images with multiple bands, it’s legal to have different widths for each band, e.g. 1 byte for L, 4 bytes for A. This dates to Pillow 2.4.0.
Created mingw-python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1958230]
Created python-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1958228]
Created python2-pillow tracking bugs for this issue:
Affects: fedora-all [bug 1958227]
Created python3-pillow tracking bugs for this issue:
Affects: epel-7 [bug 1958229]
To mitigation this feature on Red Hat Quay keep the invoice generation feature disabled as it is by default.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2021:4149 https://access.redhat.com/errata/RHSA-2021:4149
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):