python-pillow/Pillow
1
1
Fork 0
mirror of https://github.com/python-pillow/Pillow.git synced 2025-01-13 18:56:17 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #6012 from radarhere/releasenotes

Browse Source 
Added release notes for 9.0.1
This commit is contained in:
Andrew Murray 2022-02-03 10:41:04 +11:00 committed by GitHub
commit e3d98c9aca
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/releasenotes/9.0.1.rst Normal file
View File

@ -0,0 +1,23 @@
9.0.1
-----
Security
========
This release addresses several security problems.
:cve:`CVE-2022-24303`: If the path to the temporary directory on Linux or macOS
contained a space, this would break removal of the temporary image file after
``im.show()`` (and related actions), and potentially remove an unrelated file. This
been present since PIL.
:cve:`CVE-2022-22817`: While Pillow 9.0 restricted top-level builtins available to
:py:meth:`PIL.ImageMath.eval`, it did not prevent builtins available to lambda
expressions. These are now also restricted.
Other Changes
=============
Pillow 9.0 added support for ``xdg-open`` as an image viewer, but there have been
reports that the temporary image file was removed too quickly to be loaded into the
final application. A delay has been added.

1
docs/releasenotes/index.rst
View File

@ -14,6 +14,7 @@ expected to be backported to earlier versions.
.. toctree::
:maxdepth: 2
9.0.1
9.0.0
8.4.0
8.3.2