python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2024-09-21 11:28:58 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #67 from radarhere/update-release-notes

Browse Source 
Expanded "OOB" to "out-of-bounds"
This commit is contained in:
Hugo van Kemenade 2021-03-02 15:12:11 +02:00 committed by GitHub
commit b23e261300
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/releasenotes/7.1.0.rst
View File

@ -74,7 +74,7 @@ Security
This release includes security fixes. This release includes security fixes.
* :cve:`CVE-2020-10177` Fix multiple OOB reads in FLI decoding * :cve:`CVE-2020-10177` Fix multiple out-of-bounds reads in FLI decoding
* :cve:`CVE-2020-10378` Fix bounds overflow in PCX decoding * :cve:`CVE-2020-10378` Fix bounds overflow in PCX decoding
* :cve:`CVE-2020-10379` Fix two buffer overflows in TIFF decoding * :cve:`CVE-2020-10379` Fix two buffer overflows in TIFF decoding
* :cve:`CVE-2020-10994` Fix bounds overflow in JPEG 2000 decoding * :cve:`CVE-2020-10994` Fix bounds overflow in JPEG 2000 decoding

13
docs/releasenotes/8.1.0.rst
View File

@ -46,13 +46,14 @@ The PCX image decoder used the reported image stride to calculate the row buffer
rather than calculating it from the image size. This issue dates back to the PIL fork. rather than calculating it from the image size. This issue dates back to the PIL fork.
Thanks to Google's `OSS-Fuzz`_ project for finding this. Thanks to Google's `OSS-Fuzz`_ project for finding this.
* :cve:`CVE-2020-35654` Fix TIFF OOB Write error * :cve:`CVE-2020-35654` Fix TIFF out-of-bounds write error
OOB Write in ``TiffDecode.c`` when reading corrupt YCbCr files in some LibTIFF versions Out-of-bounds write in ``TiffDecode.c`` when reading corrupt YCbCr files in some
(4.1.0/Ubuntu 20.04, but not 4.0.9/Ubuntu 18.04). In some cases LibTIFF's LibTIFF versions (4.1.0/Ubuntu 20.04, but not 4.0.9/Ubuntu 18.04). In some cases
interpretation of the file is different when reading in RGBA mode, leading to an Out of LibTIFF's interpretation of the file is different when reading in RGBA mode, leading to
bounds write in ``TiffDecode.c``. This potentially affects Pillow versions from 6.0.0 to an out-of-bounds write in ``TiffDecode.c``. This potentially affects Pillow versions
8.0.1, depending on the version of LibTIFF. This was reported through `Tidelift`_. from 6.0.0 to 8.0.1, depending on the version of LibTIFF. This was reported through
`Tidelift`_.
* :cve:`CVE-2020-35655` Fix for SGI Decode buffer overrun * :cve:`CVE-2020-35655` Fix for SGI Decode buffer overrun