-
pillow (5.1.0-1ubuntu0.8) bionic-security; urgency=medium
* SECURITY UPDATE: incomplete fix for CVE-2022-22817
- debian/patches/CVE-2022-22817-2.patch: restrict builtins within
lambdas for ImageMath.eval in Tests/test_imagemath.py,
src/PIL/ImageMath.py.
- CVE-2022-22817
-- Marc Deslauriers <email address hidden> Thu, 20 Oct 2022 11:32:25 -0400
-
pillow (5.1.0-1ubuntu0.7) bionic-security; urgency=medium
* SECURITY UPDATE: regular expression DoS
- debian/patches/CVE-2021-23437.patch: raise ValueError if color
specifier is too long in Tests/test_imagecolor.py,
src/PIL/ImageColor.py.
- CVE-2021-23437
* SECURITY UPDATE: Dos via buffer overflow
- debian/patches/CVE-2021-34552.patch: limit sprintf modes to 10
characters in src/libImaging/Convert.c.
- CVE-2021-34552
* SECURITY UPDATE: improper initialization
- debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
in src/path.c.
- CVE-2022-22815
* SECURITY UPDATE: buffer over-read during initialization
- debian/patches/CVE-2022-22816.patch: handle case where path count is
zero in src/path.c.
- CVE-2022-22816
* SECURITY UPDATE: evaluation of arbitrary expressions
- debian/patches/CVE-2022-22817.patch: restrict builtins for
ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
- CVE-2022-22817
-- Marc Deslauriers <email address hidden> Wed, 12 Jan 2022 13:21:48 -0500
-
pillow (5.1.0-1ubuntu0.6) bionic-security; urgency=medium
* SECURITY UPDATE: OOB read in Jpeg2KDecode
- debian/patches/CVE-2021-25287_8.patch: handle different widths for
each band in src/libImaging/Jpeg2KDecode.c.
- CVE-2021-25287
- CVE-2021-25288
* SECURITY UPDATE: DOS in PsdImagePlugin
- debian/patches/CVE-2021-28675.patch: sanity check the number of
input layers in Tests/test_decompression_bomb.py,
Tests/test_file_apng.py, Tests/test_file_blp.py,
Tests/test_file_tiff.py, src/PIL/ImageFile.py,
src/PIL/PsdImagePlugin.py.
- CVE-2021-28675
* SECURITY UPDATE: FLI DOS
- debian/patches/CVE-2021-28676.patch: check the block advance in
src/libImaging/FliDecode.c.
- CVE-2021-28676
* SECURITY UPDATE: EPS DOS on _open
- debian/patches/CVE-2021-28677.patch: properly handle line endings in
src/PIL/EpsImagePlugin.py.
- CVE-2021-28677
* SECURITY UPDATE: BLP DOS
- debian/patches/CVE-2021-28678.patch: check that reads return data in
src/PIL/BlpImagePlugin.py.
- CVE-2021-28678
-- Marc Deslauriers <email address hidden> Tue, 18 May 2021 07:33:36 -0400
-
pillow (5.1.0-1ubuntu0.5) bionic-security; urgency=medium
* SECURITY UPDATE: negative-offset memcpy with an invalid size
- debian/patches/CVE-2021-25290.patch: add extra check to
src/libImaging/TiffDecode.c.
- CVE-2021-25290
* SECURITY UPDATE: DoS via backtrack regex
- debian/patches/CVE-2021-25292.patch: use more specific regex in
src/PIL/PdfParser.py.
- CVE-2021-25292
* SECURITY UPDATE: Out of Bounds Read
- debian/patches/CVE-2021-25293.patch: add more checks to
src/libImaging/SgiRleDecode.c.
- CVE-2021-25293
* SECURITY UPDATE: DoS via invalid reported size
- debian/patches/CVE-2021-2792x.patch: check reported sizes in
src/PIL/BlpImagePlugin.py, src/PIL/IcnsImagePlugin.py,
src/PIL/IcoImagePlugin.py.
- CVE-2021-27921
- CVE-2021-27922
- CVE-2021-27923
-- Marc Deslauriers <email address hidden> Wed, 10 Mar 2021 13:01:32 -0500
-
pillow (5.1.0-1ubuntu0.4) bionic-security; urgency=medium
* SECURITY UPDATE: buffer over-read via PCX file
- debian/patches/CVE-2020-35653.patch: don't trust the image to specify
a buffer size in src/PIL/PcxImagePlugin.py.
- CVE-2020-35653
* SECURITY UPDATE: buffer over-read via SGI RLE image file
- debian/patches/CVE-2020-35655-1.patch: add checks to
src/libImaging/SgiRleDecode.c.
- debian/patches/CVE-2020-35655-2.patch: rework error flags in
src/libImaging/SgiRleDecode.c.
- CVE-2020-35655
-- Marc Deslauriers <email address hidden> Wed, 13 Jan 2021 10:51:02 -0500
-
pillow (5.1.0-1ubuntu0.3) bionic-security; urgency=medium
* SECURITY UPDATE: multiple out of bounds reads
- debian/patches/CVE-2020-10177-1.patch: fix issue in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-2.patch: refactor to macro in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
in src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-7.patch: fix comments in
src/libImaging/FliDecode.c.
- debian/patches/CVE-2020-10177-8.patch: additional FLI check in
src/libImaging/FliDecode.c.
- CVE-2020-10177
* SECURITY UPDATE: out of bounds read with PCX files
- debian/patches/CVE-2020-10378.patch: fix OOB Access in
src/libImaging/PcxDecode.c.
- CVE-2020-10378
* SECURITY UPDATE: out-of-bounds read via JP2 file
- debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
src/libImaging/Jpeg2KDecode.c.
- debian/patches/CVE-2020-10994-2.patch: fix typo in
src/libImaging/Jpeg2KDecode.c.
- CVE-2020-10994
* SECURITY UPDATE: out-of-bounds read via SGI file
- debian/patches/CVE-2020-11538.patch: track number of pixels, not the
number of runs in src/libImaging/SgiRleDecode.c.
- CVE-2020-11538
-- Marc Deslauriers <email address hidden> Tue, 07 Jul 2020 13:35:30 -0400
-
pillow (5.1.0-1ubuntu0.2) bionic-security; urgency=medium
* SECURITY UPDATE: Exceed memory amount and delay in process image
- debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
PIL/PsdImagePlugin.py, Added decompression bomb checks in
PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
in Tests/images/*.
- CVE-2019-16865
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2019-19911.patch: Raise an error for an invalid
number of bands in FPX image in PIL/FpxImagePlugin.py and added some
testes in Test/images/*.
- CVE-2019-19911
* SECURITY UPDATE: Buffer overflow
- debian/patches/CVE-2020-5311.patch: catch SGI buffer overruns
in src/libImaging/SgiRleDecode.c.
- CVE-2020-5311
* SECURITY UPDATE: Buffer overflow
- debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
in libImaging/PcxDecode.c and added some tests in Test/images/*.
- CVE-2020-5312
* SECURITY UPDATE: Buffer overflow
- debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
libImaging/FliDecode.c and added some tests in Test/images/*.
- CVE-2020-5313
-- <email address hidden> (Leonidas S. Barbosa) Mon, 03 Feb 2020 13:04:40 -0300
-
pillow (5.1.0-1) unstable; urgency=medium
* New upstream version.
* Add recommendations for olefile.
-- Matthias Klose <email address hidden> Mon, 09 Apr 2018 15:43:37 +0200
-
pillow (5.0.0-1) unstable; urgency=medium
* New upstream version.
- Closing old python-imaging issues. Closes: #510877, #708449, #806973.
- Example scripts not installed anymore. Closes: #513536, #554906.
* Stop building the python-imaging package.
* Build-depend on libraqm-dev.
* python-pil-doc: Stop suggesting python-pil-doc-html. Closes: #814567.
-- Matthias Klose <email address hidden> Sat, 06 Jan 2018 00:24:59 +0100
-
pillow (4.3.0-2ubuntu1) bionic; urgency=medium
* Apply fix for upstream issue #2825. Not updating the binary test
files, not running the test on 32bit targets.
-- Matthias Klose <email address hidden> Sat, 16 Dec 2017 09:21:02 +0100
-
pillow (4.3.0-2) unstable; urgency=medium
* Install the ImagingUtils.h header file. Closes: #879788.
-- Matthias Klose <email address hidden> Thu, 26 Oct 2017 08:53:42 +0200
-
pillow (4.1.1-3build2) artful; urgency=medium
* No change rebuild to drop Python 3.5 support.
-- Michael Hudson-Doyle <email address hidden> Mon, 14 Aug 2017 13:28:56 +1200
