python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-08-11 15:54:45 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10 from ActiveState/BE-152-cve-2021-27922

Browse Source 
Update changelogs with fixes that were already in, BE-584, BE-151, BE…
This commit is contained in:
Marc Gutman 2023-03-13 16:40:30 -05:00 committed by GitHub
commit c3851b77ca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
CHANGES.rst
View File

@ -12,7 +12,11 @@ Changelog (Pillow)
since Pillow 4.3.0. since Pillow 4.3.0.
[rickprice] [rickprice]
- Fix CVE-2021-27291 - Fix CVE-2021-27921
[rickprice]
- Fix CVE-2021-27922
[rickprice]
- Fix CVE-2021-27923
[rickprice] [rickprice]
- Fix CVE-2021-25290 - Fix CVE-2021-25290
@ -40,7 +44,7 @@ since Pillow 4.3.0.
- Use snprintf instead of sprintf. CVE-2021-34552 - Use snprintf instead of sprintf. CVE-2021-34552
[wooken] [wooken]
6.2.2.1 (2021-10-08) 6.2.2.1 (2021-10-08)
------------------ ------------------

7
docs/releasenotes/6.2.2.4.rst
View File

@ -11,6 +11,11 @@ since Pillow 4.3.0.
:cve: `CVE-2021-25291`: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries. :cve: `CVE-2021-25291`: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
:cve: `CVE-2021-2791` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large. :cve: `CVE-2021-27921` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-27922` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-27923` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-25290` : Fix negative size read in TiffDecode.c :cve: `CVE-2021-25290` : Fix negative size read in TiffDecode.c