python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-08-11 15:54:45 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10 from ActiveState/BE-152-cve-2021-27922

Browse Source 
Update changelogs with fixes that were already in, BE-584, BE-151, BE…
This commit is contained in:
Marc Gutman 2023-03-13 16:40:30 -05:00 committed by GitHub
commit c3851b77ca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES.rst
View File

@ -12,7 +12,11 @@ Changelog (Pillow)
since Pillow 4.3.0.
[rickprice]
- Fix CVE-2021-27291
- Fix CVE-2021-27921
[rickprice]
- Fix CVE-2021-27922
[rickprice]
- Fix CVE-2021-27923
[rickprice]
- Fix CVE-2021-25290

7
docs/releasenotes/6.2.2.4.rst
View File

@ -11,6 +11,11 @@ since Pillow 4.3.0.
:cve: `CVE-2021-25291`: An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.
:cve: `CVE-2021-2791` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-27921` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-27922` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-27923` : Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.
:cve: `CVE-2021-25290` : Fix negative size read in TiffDecode.c