Skip to content

Commit 944367d

Browse files
aclark4lifeaclark4life
committed
Fix headers and retro-add notes for #7864
- Include CVE link in title (via @hugovk) - Retro-add release notes for 2.3.2, 2.5.2 for CVE-2014-3589
1 parent 0b2c90d commit 944367d

23 files changed

+137
-254
lines changed

‎docs/releasenotes/10.0.0.rst‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,10 @@ now been fixed.
1414
This effectively dates to the PIL fork, since problem images would still have
1515
been processed before Pillow started checking for decompression bombs.
1616

17-
Fix CVE-2023-44271
18-
^^^^^^^^^^^^^^^^^^
17+
.. _Added ImageFont.MAX_STRING_LENGTH:
1918

20-
.. note:: More information about this vulnerability included in database record :cve:`2023-44271`
21-
22-
Added ImageFont.MAX_STRING_LENGTH
23-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
19+
:cve:`2023-44271`: Added ImageFont.MAX_STRING_LENGTH
20+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2421

2522
To protect against potential DOS attacks when using arbitrary strings as text
2623
input, Pillow will now raise a :py:exc:`ValueError` if the number of characters

‎docs/releasenotes/10.0.1.rst‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,12 @@
44
Security
55
========
66

7-
Fix CVE-2023-4863
8-
^^^^^^^^^^^^^^^^^
9-
10-
.. note:: More information about this vulnerability included in database record :cve:`2023-4863`
7+
:cve:`2023-4863`: Updated install script and updated wheels
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
119

1210
This release provides an updated install script and updated wheels to
13-
include libwebp 1.3.2, preventing a potential heap buffer overflow in WebP.
11+
include libwebp 1.3.2, preventing a potential heap buffer overflow in
12+
WebP.
1413

1514
Updated tests to pass with latest zlib version
1615
==============================================

‎docs/releasenotes/10.2.0.rst‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,13 +25,8 @@ To protect against potential DOS attacks when using PIL fonts,
2525
:py:class:`PIL.ImageFont.ImageFont` now trims the size of individual glyphs so that
2626
they do not extend beyond the bitmap image.
2727

28-
Fix CVE-2023-50447
29-
^^^^^^^^^^^^^^^^^^
30-
31-
.. note:: More information about this vulnerability included in database record :cve:`2023-50447`
32-
33-
ImageMath.eval: Restricted environment keys
34-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
28+
:cve:`2023-50447`: ImageMath.eval: Restricted environment keys
29+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
3530

3631
If an attacker has control over the keys passed to the
3732
``environment`` argument of :py:meth:`PIL.ImageMath.eval`, they may be able to execute

‎docs/releasenotes/2.3.1.rst‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,14 @@
44
Security
55
========
66

7-
Fix CVE-2014-1932, CVE-2014-1933
8-
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7+
These issues reported in `Debian bug #737059 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059>`_.
98

10-
.. note:: More information about these vulnerabilities included in database records :cve:`2014-1932`, :cve:`2014-1933`
9+
:cve:`2014-1932`: Fix insecure use of :py:func:`tempfile.mktemp`
10+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1111

12-
Fix insecure use of :py:func:`tempfile.mktemp` as reported in
13-
`Debian bug #737059 <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059>`_.
12+
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
13+
14+
:cve:`2014-1933`: Fix insecure use of :py:func:`tempfile.mktemp`
15+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
16+
17+
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

‎docs/releasenotes/2.3.2.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2.3.2
2+
-----
3+
4+
Security
5+
========
6+
7+
:cve:`2014-3589`: Fix DOS attack
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
9+
10+
``PIL/IcnsImagePlugin.py`` in Python Imaging Library (PIL) and Pillow before 2.3.2 and
11+
2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted
12+
block size.

‎docs/releasenotes/2.5.2.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
2.5.2
2+
-----
3+
4+
Security
5+
========
6+
7+
:cve:`2014-3589`: Fix DOS attack
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
9+
10+
``PIL/IcnsImagePlugin.py`` in Python Imaging Library (PIL) and Pillow before 2.3.2 and
11+
2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted
12+
block size.

‎docs/releasenotes/3.1.1.rst‎

Lines changed: 8 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,8 @@
44
Security
55
========
66

7-
Fix CVE-2016-0740
8-
^^^^^^^^^^^^^^^^^
9-
10-
.. note:: More information about this vulnerability included in database record :cve:`2016-0740`
11-
12-
Buffer overflow in TiffDecode.c
13-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7+
:cve:`2016-0740`: Buffer overflow in TiffDecode.c
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
149

1510
Pillow 3.1.0 and earlier when linked against
1611
libtiff >= 4.0.0 on x64 may overflow a buffer when reading a
@@ -27,16 +22,11 @@ image data over 64k is written over the heap, causing a segfault.
2722

2823
This issue was found by security researcher FourOne.
2924

30-
Fix CVE-2016-0775
31-
^^^^^^^^^^^^^^^^^
32-
33-
.. note:: More information about this vulnerability included in database record :cve:`2016-0775`
25+
:cve:`2016-0775`: Buffer overflow in FliDecode.c
26+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
3427

35-
Buffer overflow in FliDecode.c
36-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
37-
38-
In all versions of Pillow, dating back at least to
39-
the last PIL 1.1.7 release, FliDecode.c has a buffer overflow error.
28+
In all versions of Pillow, dating back at least to the last PIL 1.1.7
29+
release, FliDecode.c has a buffer overflow error.
4030

4131
Around line 192:
4232

@@ -61,13 +51,8 @@ off the end of the memory buffer, causing a segfault.
6151

6252
This issue was found by Alyssa Besseling at Atlassian.
6353

64-
Fix CVE-2016-2533
65-
^^^^^^^^^^^^^^^^^
66-
67-
.. note:: More information about this vulnerability available in :cve:`2016-2533`
68-
69-
Buffer overflow in PcdDecode.c
70-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
54+
:cve:`2016-2533`: Buffer overflow in PcdDecode.c
55+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7156

7257
In all versions of Pillow, dating back at least to the
7358
last PIL 1.1.7 release, ``PcdDecode.c`` has a buffer overflow error.

‎docs/releasenotes/3.1.2.rst‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,8 @@
44
Security
55
========
66

7-
Fix CVE-2016-3076
8-
^^^^^^^^^^^^^^^^^
9-
10-
.. note:: More information about this vulnerability included in database record :cve:`2016-3076`
11-
12-
Buffer overflow in Jpeg2KEncode.c
13-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
7+
:cve:`2016-3076`: Buffer overflow in Jpeg2KEncode.c
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
149

1510
Pillow between 2.5.0 and 3.1.1 may overflow a buffer
1611
when writing large Jpeg2000 files, allowing for code execution or other

‎docs/releasenotes/6.2.0.rst‎

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,11 @@ Decompression bomb checks have been added to GIF and ICO formats.
2323
An error is now raised if a TIFF dimension is a string, rather than trying to
2424
perform operations on it.
2525

26-
Fix CVE-2019-16865
27-
^^^^^^^^^^^^^^^^^^
26+
:cve:`2019-16865`: Fix DOS attack
27+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2828

29-
.. note:: More information about this vulnerability included in database record :cve:`2019-16865`
30-
31-
The CVE is regarding DOS problems, such as consuming large
32-
amounts of memory, or taking a large amount of time to process an image.
29+
The CVE is regarding DOS problems, such as consuming large amounts of memory,
30+
or taking a large amount of time to process an image.
3331

3432
API Additions
3533
=============

‎docs/releasenotes/6.2.2.rst‎

Lines changed: 12 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,45 +4,32 @@
44
Security
55
========
66

7-
This release fixes several buffer overruns and DOS attacks reported in CVE-2019-19911, CVE-2020-5310, CVE-2020-5311, CVE-2020-5312 and CVE-2020-5313.
7+
This release fixes several buffer overruns and DOS attacks.
88

9-
Fix CVE-2019-19911
10-
^^^^^^^^^^^^^^^^^^
11-
12-
.. note:: More information about this vulnerability included in database record :cve:`2019-19911`
13-
14-
DOS attack vulnerability
15-
~~~~~~~~~~~~~~~~~~~~~~~~
9+
:cve:`2019-19911`: DOS attack vulnerability
10+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1611

1712
If an FPX image reports that it has a large number of bands, a large amount of
1813
resources will be used when trying to process the image. This is fixed by
1914
limiting the number of bands to those usable by Pillow.
2015

21-
Fix CVE-2020-5310
22-
^^^^^^^^^^^^^^^^^
23-
24-
.. note:: More information about this vulnerability included in database record :cve:`2020-5310`
16+
:cve:`2020-5310`: Overflow checks added to TIFF image processing
17+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2518

2619
Overflow checks have been added when calculating the size of a memory block to be reallocated
2720
in the processing of a TIFF image.
2821

29-
Fix CVE-2020-5311
30-
^^^^^^^^^^^^^^^^^
31-
32-
.. note:: More information about this vulnerability included in database record :cve:`2020-5311`
22+
:cve:`2020-5311`: Overflow checks added to SGI image processing
23+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
3324

3425
Buffer overruns were found when processing an SGI image. Checks have been added to prevent this.
3526

36-
Fix CVE-2020-5312
37-
^^^^^^^^^^^^^^^^^
38-
39-
.. note:: More information about this vulnerability included in database record :cve:`2020-5312`
40-
41-
Buffer overruns were found when processing an SGI PCX. Checks have been added to prevent this.
27+
:cve:`2020-5312`: Overflow checks added to PCX image processing
28+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
4229

43-
Fix CVE-2020-5313
44-
^^^^^^^^^^^^^^^^^
30+
Buffer overruns were found when processing a PCX image. Checks have been added to prevent this.
4531

46-
.. note:: More information about this vulnerability included in database record :cve:`2020-5313`
32+
:cve:`2020-5313`: Overflow checks added to FLI image processing
33+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
4734

4835
Buffer overruns were found when processing an FLI image. Checks have been added to prevent this.

0 commit comments

Comments
 (0)