python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-12-25 17:36:18 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #5176 from radarhere/security

Browse Source 
Document CVE fixes
This commit is contained in:
Andrew Murray 2021-01-02 22:37:19 +11:00 committed by GitHub
commit 470e48be4f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 35 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
CHANGES.rst
View File

@ -5,6 +5,15 @@ Changelog (Pillow)
8.1.0 (unreleased)
------------------
- Fix TIFF OOB Write error. CVE-2020-35654 #5175
[wiredfool]
- Fix for Read Overflow in PCX Decoding. CVE-2020-35653 #5174
[wiredfool, radarhere]
- Fix for SGI Decode buffer overrun. CVE-2020-35655 #5173
[wiredfool, radarhere]
- Fix OOB Read when saving GIF of xsize=1 #5149
[wiredfool]

36
docs/releasenotes/8.1.0.rst
View File

@ -20,14 +20,6 @@ Makefile
The 'install-venv' target has been deprecated.
API Changes
===========
TODO
^^^^
TODO
API Additions
=============
@ -44,8 +36,32 @@ already exists for the ICNS format.
Security
========
An out-of-bounds read when saving TIFFs with custom metadata through libtiff has been
fixed, as well as when saving a GIF of 1px width.
This release includes security fixes.
* An out-of-bounds read when saving TIFFs with custom metadata through LibTIFF
* An out-of-bounds read when saving a GIF of 1px width
* :cve:`CVE-2020-35653` Buffer read overrun in PCX decoding
The PCX image decoder used the reported image stride to calculate the row buffer,
rather than calculating it from the image size. This issue dates back to the PIL fork.
Thanks to Google's `OSS-Fuzz`_ project for finding this.
* :cve:`CVE-2020-35654` Fix TIFF OOB Write error
OOB Write in TiffDecode.c when reading corrupt YCbCr files in some LibTIFF versions
(4.1.0/Ubuntu 20.04, but not 4.0.9/Ubuntu 18.04). In some cases LibTIFF's
interpretation of the file is different when reading in RGBA mode, leading to an Out of
bounds write in TiffDecode.c. This potentially affects Pillow versions from 6.0.0 to
8.0.1, depending on the version of LibTIFF. This was reported through `Tidelift`_.
* :cve:`CVE-2020-35655` Fix for SGI Decode buffer overrun
4 byte read overflow in SGIRleDecode.c, where the code was not correctly checking the
offsets and length tables. Independently reported through `Tidelift`_ and Google's
`OSS-Fuzz`_. This vulnerability covers Pillow versions 4.3.0->8.0.1.
.. _Tidelift: https://tidelift.com/subscription/pkg/pypi-pillow?utm_source=pillow&utm_medium=referral&utm_campaign=docs
.. _OSS-Fuzz: https://github.com/google/oss-fuzz
Dependencies
^^^^^^^^^^^^