diff --git a/CHANGES.rst b/CHANGES.rst index cc6efc070..e85716f80 100644 --- a/CHANGES.rst +++ b/CHANGES.rst @@ -2,10 +2,29 @@ Changelog (Pillow) ================== -6.2.1 (2019-10-21) +6.2.2 (2020-01-02) +------------------ - This is the last Pillow release to support Python 2.7 #3642 +- Overflow checks for realloc for tiff decoding. CVE TBD + [wiredfool, radarhere] + +- Catch SGI buffer overrun. CVE TBD + [radarhere] + +- Catch PCX P mode buffer overrun. CVE TBD + [radarhere] + +- Catch FLI buffer overrun. CVE TBD + [radarhere] + +- Raise an error for an invalid number of bands in FPX image. CVE-2019-19911 + [wiredfool, radarhere] + +6.2.1 (2019-10-21) +------------------ + - Add support for Python 3.8 #4141 [hugovk] diff --git a/docs/releasenotes/6.2.2.rst b/docs/releasenotes/6.2.2.rst new file mode 100644 index 000000000..586ea7d85 --- /dev/null +++ b/docs/releasenotes/6.2.2.rst @@ -0,0 +1,18 @@ +6.2.2 +----- + +Security +======== + +This release addresses several security problems {CVEs TBD), as well as addressing +CVE-2019-19911. + +CVE-2019-19911 is regarding FPX images. If an image reports that it has a large number +of bands, a large amount of resources will be used when trying to process the +image. This is fixed by limiting the number of bands to those usable by Pillow. + +Buffer overruns were found when processing an SGI, PCX or FLI image. Checks +have been added to prevent this. + +Overflow checks have been added when calculating the size of a memory block to +be reallocated in the processing of a TIFF image.