ALT-PU-2026-19069: package python3-module-psd-tools update to version 1.25.0-alt1
Описание
This update upgrades python3-module-psd-tools to version 1.25.0-alt1.
Устраненные уязвимости2
Ссылки9
GHSA-2rmg-vrx8-9j2f
https://github.com/advisories/GHSA-2rmg-vrx8-9j2fGHSA-72jg-v7jq-m6p3
https://github.com/advisories/GHSA-72jg-v7jq-m6p3GHSA-7m55-42q7-888r
https://github.com/advisories/GHSA-7m55-42q7-888rGHSA-8q6g-vjhf-jp8m
https://github.com/advisories/GHSA-8q6g-vjhf-jp8mGHSA-mg89-vfv6-5pm4
https://github.com/advisories/GHSA-mg89-vfv6-5pm4GHSA-r6c8-3pw3-m54g
https://github.com/advisories/GHSA-r6c8-3pw3-m54gGHSA-v7vq-grqq-m352
https://github.com/advisories/GHSA-v7vq-grqq-m352GHSA-vq54-2qvv-mf8w
https://github.com/advisories/GHSA-vq54-2qvv-mf8wСвязанные уязвимости
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those values against the available file data. A tiny crafted PSD could therefore cause multi-gigabyte memory allocation, and PSDImage.composite() could return a black image with only a warning instead of raising an exception. Services that composite untrusted PSD files could be terminated by out-of-memory handling. This issue is fixed in version 1.17.4.
psd-tools is a Python package for working with Adobe Photoshop PSD fil ...
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.
psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim from the PSD file. Because that name is attacker-controlled and unsanitised, a tool that extracts embedded objects from an untrusted `.psd` can be made to write attacker-chosen bytes to an attacker-chosen path (absolute or `../`-traversing), outside its intended output directory. A secondary issue in `SmartObject.open()` for external-kind smart objects allows the attacker-controlled `fullPath` descriptor to be used as an arbitrary file read path, enabling exfiltration of the read content to the controlled write destination. Both issues are fixed in v1.17.1.