Change log : pillow package : Ubuntu

10.2.0-1ubuntu1

Superseded in oracular-proposed on 2024-05-14

Superseded in oracular-proposed on 2024-04-30

Published in noble-updates on 2024-04-29

Published in noble-security on 2024-04-29

pillow (10.2.0-1ubuntu1) noble; urgency=medium

  * SECURITY UPDATE: Buffer overflow in imagingcms.c
    - debian/patches/CVE-2024-28219.patch: Use strncpy
    to avoid buffer overflow
    - CVE-2024-28219

 -- Nick Galanis <email address hidden>  Mon, 15 Apr 2024 15:10:42 +0100

Available diffs

diff from 10.2.0-1 (in Debian) to 10.2.0-1ubuntu1 (1.6 KiB)

10.0.0-1ubuntu0.2

Published in mantic-updates on 2024-04-22

Published in mantic-security on 2024-04-22

pillow (10.0.0-1ubuntu0.2) mantic-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in imagingcms.c
    - debian/patches/CVE-2024-28219.patch: Use strncpy
    to avoid buffer overflow
    - CVE-2024-28219

 -- Nick Galanis <email address hidden>  Mon, 15 Apr 2024 14:52:02 +0100

Available diffs

diff from 10.0.0-1ubuntu0.1 to 10.0.0-1ubuntu0.2 (1.3 KiB)

9.0.1-1ubuntu0.3

Published in jammy-updates on 2024-04-22

Published in jammy-security on 2024-04-22

pillow (9.0.1-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in imagingcms.c
    - debian/patches/CVE-2024-28219.patch: Use strncpy
    to avoid buffer overflow
    - CVE-2024-28219

 -- Nick Galanis <email address hidden>  Mon, 15 Apr 2024 13:00:29 +0100

Available diffs

diff from 9.0.1-1ubuntu0.2 to 9.0.1-1ubuntu0.3 (1.3 KiB)

7.0.0-4ubuntu0.9

Published in focal-updates on 2024-04-22

Published in focal-security on 2024-04-22

pillow (7.0.0-4ubuntu0.9) focal-security; urgency=medium

  * SECURITY UPDATE: Buffer overflow in imagingcms.c
    - debian/patches/CVE-2024-28219.patch: Use strncpy
    to avoid buffer overflow
    - CVE-2024-28219

 -- Nick Galanis <email address hidden>  Fri, 12 Apr 2024 15:21:40 +0100

Available diffs

diff from 7.0.0-4ubuntu0.8 to 7.0.0-4ubuntu0.9 (1.3 KiB)

10.2.0-1build1

Published in oracular-release on 2024-04-29

Published in noble-release on 2024-04-16

Deleted in noble-proposed (Reason: Moved to noble)

pillow (10.2.0-1build1) noble; urgency=high

  * No change rebuild for 64-bit time_t and frame pointers.

 -- Julian Andres Klode <email address hidden>  Mon, 08 Apr 2024 18:15:35 +0200

Available diffs

diff from 10.2.0-1 (in Debian) to 10.2.0-1build1 (584 bytes)

10.3.0-2

Published in oracular-proposed on 2024-05-14

pillow (10.3.0-2) unstable; urgency=medium

  * Allow stderr in autopkg tests, deprecation warning for Pillow 12.

 -- Matthias Klose <email address hidden>  Wed, 03 Apr 2024 09:03:08 +0200

Available diffs

diff from 10.2.0-1ubuntu1 (in ~ubuntu-security-proposed/ubuntu/ppa) to 10.3.0-2 (397.7 KiB)

7.0.0-4ubuntu0.8

Superseded in focal-updates on 2024-04-22

Superseded in focal-security on 2024-04-22

pillow (7.0.0-4ubuntu0.8) focal-security; urgency=medium

  * SECURITY UPDATE: DoS in ImageFont via large textlength
    - debian/patches/CVE-2023-44271.patch: added a maximum string length in
      Tests/test_imagefont.py, docs/reference/ImageFont.rst,
      src/PIL/ImageFont.py.
    - CVE-2023-44271
  * SECURITY UPDATE: PIL.ImageMath.eval Arbitrary Code Execution
    - debian/patches/CVE-2023-50447-1.patch: don't allow __ or builtins in
      env dictionarys for ImageMath.eval in src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-2.patch: allow ops in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-3.patch: include further builtins in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2023-50447

 -- Marc Deslauriers <email address hidden>  Thu, 25 Jan 2024 12:48:42 -0500

Available diffs

diff from 7.0.0-4ubuntu0.7 to 7.0.0-4ubuntu0.8 (3.8 KiB)

9.0.1-1ubuntu0.2

Superseded in jammy-updates on 2024-04-22

Superseded in jammy-security on 2024-04-22

pillow (9.0.1-1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: DoS in ImageFont via large textlength
    - debian/patches/CVE-2023-44271.patch: added a maximum string length in
      Tests/test_imagefont.py, docs/reference/ImageFont.rst,
      src/PIL/ImageFont.py.
    - CVE-2023-44271
  * SECURITY UPDATE: PIL.ImageMath.eval Arbitrary Code Execution
    - debian/patches/CVE-2023-50447-1.patch: don't allow __ or builtins in
      env dictionarys for ImageMath.eval in src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-2.patch: allow ops in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-3.patch: include further builtins in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2023-50447

 -- Marc Deslauriers <email address hidden>  Thu, 25 Jan 2024 10:10:10 -0500

Available diffs

diff from 8.1.2+dfsg-0.3 (in Debian) to 9.0.1-1ubuntu0.2 (510.2 KiB)
diff from 9.0.1-1ubuntu0.1 to 9.0.1-1ubuntu0.2 (3.8 KiB)

10.0.0-1ubuntu0.1

Superseded in mantic-updates on 2024-04-22

Superseded in mantic-security on 2024-04-22

pillow (10.0.0-1ubuntu0.1) mantic-security; urgency=medium

  * SECURITY UPDATE: PIL.ImageMath.eval Arbitrary Code Execution
    - debian/patches/CVE-2023-50447-1.patch: don't allow __ or builtins in
      env dictionarys for ImageMath.eval in src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-2.patch: allow ops in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - debian/patches/CVE-2023-50447-3.patch: include further builtins in
      Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2023-50447

 -- Marc Deslauriers <email address hidden>  Thu, 25 Jan 2024 10:02:07 -0500

Available diffs

diff from 10.0.0-1 (in Debian) to 10.0.0-1ubuntu0.1 (2.1 KiB)

10.2.0-1

Superseded in noble-release on 2024-04-16

Deleted in noble-proposed on 2024-04-17 (Reason: Moved to noble)

pillow (10.2.0-1) unstable; urgency=medium

  * New upstream version. Addresses CVE-2023-50447. Closes: #1061172.

 -- Matthias Klose <email address hidden>  Sat, 20 Jan 2024 10:47:10 +0100

Available diffs

diff from 10.1.0-1 to 10.2.0-1 (136.5 KiB)

10.1.0-1

Superseded in noble-release on 2024-01-27

Deleted in noble-proposed on 2024-01-29 (Reason: Moved to noble)

pillow (10.1.0-1) unstable; urgency=medium

  * New upstream version.
  * Depend on media-types instead of mime-support. Closes: #987500.

 -- Matthias Klose <email address hidden>  Tue, 31 Oct 2023 13:24:15 +0100

Available diffs

diff from 10.0.0-1 to 10.1.0-1 (73.2 KiB)

10.0.0-1

Superseded in noble-release on 2023-12-21

Published in mantic-release on 2023-07-26

Deleted in mantic-proposed (Reason: Moved to mantic)

pillow (10.0.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Wed, 05 Jul 2023 18:58:54 +0200

Available diffs

diff from 9.5.0-1 to 10.0.0-1 (65.0 KiB)

9.5.0-1

Superseded in mantic-release on 2023-07-26

Deleted in mantic-proposed on 2023-07-27 (Reason: Moved to mantic)

pillow (9.5.0-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards version.
  * debian/patches/pkg-config-multiarch.diff: Remove, applied upstream.

 -- Matthias Klose <email address hidden>  Mon, 12 Jun 2023 09:30:20 +0200

Available diffs

diff from 9.4.0-1.1build1 (in Ubuntu) to 9.5.0-1 (95.3 KiB)

9.4.0-1.1build1

Superseded in mantic-release on 2023-06-19

Published in lunar-release on 2023-02-28

Deleted in lunar-proposed (Reason: Moved to lunar)

pillow (9.4.0-1.1build1) lunar; urgency=medium

  * Rebuild against latest tiff

 -- Jeremy Bicha <email address hidden>  Sat, 04 Feb 2023 14:40:34 -0500

Available diffs

diff from 9.4.0-1.1 (in Debian) to 9.4.0-1.1build1 (307 bytes)

9.4.0-1.1

Superseded in lunar-release on 2023-02-28

Deleted in lunar-proposed on 2023-03-01 (Reason: Moved to lunar)

pillow (9.4.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Handle more than one directory returned by pkg-config (Closes: #1028904).

 -- Bastian Germann <email address hidden>  Mon, 16 Jan 2023 16:29:25 +0100

Available diffs

diff from 9.4.0-1 to 9.4.0-1.1 (1.2 KiB)

9.4.0-1

Superseded in lunar-release on 2023-01-27

Deleted in lunar-proposed on 2023-01-28 (Reason: Moved to lunar)

pillow (9.4.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Tue, 03 Jan 2023 10:06:46 +0100

Available diffs

diff from 9.2.0-1.1ubuntu1 (in Ubuntu) to 9.4.0-1 (165.4 KiB)

7.0.0-4ubuntu0.7

Superseded in focal-updates on 2024-01-30

Superseded in focal-security on 2024-01-30

pillow (7.0.0-4ubuntu0.7) focal-security; urgency=medium

  * SECURITY UPDATE: arbitrary file deletion
    - debian/patches/CVE-2022-24303.patch: No longer remove temporary images
      manually in src/PIL/ImageShow.py.
    - CVE-2022-24303
  * SECURITY UPDATE: gif decompression bomb issue
    - debian/patches/CVE-2022-45198.patch: Added GIF decompression bomb check
      in src/PIL/GifImagePlugin.py.
    - CVE-2022-45198

 -- Fabian Toepfer <email address hidden>  Mon, 12 Dec 2022 21:23:40 +0100

Available diffs

diff from 7.0.0-4ubuntu0.6 to 7.0.0-4ubuntu0.7 (2.4 KiB)

9.0.1-1ubuntu0.1

Superseded in jammy-updates on 2024-01-30

Superseded in jammy-security on 2024-01-30

pillow (9.0.1-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: gif decompression bomb issue
    - debian/patches/CVE-2022-45198.patch: Added GIF decompression bomb check
      in src/PIL/GifImagePlugin.py.
    - CVE-2022-45198

 -- Fabian Toepfer <email address hidden>  Mon, 12 Dec 2022 20:51:28 +0100

Available diffs

diff from 9.0.1-1build1 (in Ubuntu) to 9.0.1-1ubuntu0.1 (2.0 KiB)

9.2.0-1.1ubuntu1

Superseded in lunar-release on 2023-01-21

Deleted in lunar-proposed on 2023-01-22 (Reason: Moved to lunar)

pillow (9.2.0-1.1ubuntu1) lunar; urgency=medium

  * Revert previous NMU to "fix FTBFS"

 -- Graham Inggs <email address hidden>  Mon, 28 Nov 2022 13:17:21 +0000

Available diffs

diff from 9.2.0-1 (in Debian) to 9.2.0-1.1ubuntu1 (623 bytes)
diff from 9.2.0-1.1 (in Debian) to 9.2.0-1.1ubuntu1 (683 bytes)

9.2.0-1build1

Superseded in lunar-proposed on 2022-11-06

pillow (9.2.0-1build1) lunar; urgency=medium

  * No-change rebuild with Python 3.11 as supported

 -- Graham Inggs <email address hidden>  Wed, 02 Nov 2022 15:06:40 +0000

Available diffs

diff from 9.2.0-1 (in Debian) to 9.2.0-1build1 (309 bytes)

9.2.0-1.1

Superseded in lunar-proposed on 2022-11-28

pillow (9.2.0-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Add patch to fix FTBFS (Closes: #1020043)

 -- Nilesh Patra <email address hidden>  Fri, 21 Oct 2022 15:53:14 +0000

Available diffs

diff from 9.2.0-1build1 (in Ubuntu) to 9.2.0-1.1 (558 bytes)

5.1.0-1ubuntu0.8

Published in bionic-updates on 2022-10-24

Published in bionic-security on 2022-10-24

pillow (5.1.0-1ubuntu0.8) bionic-security; urgency=medium

  * SECURITY UPDATE: incomplete fix for CVE-2022-22817
    - debian/patches/CVE-2022-22817-2.patch: restrict builtins within
      lambdas for ImageMath.eval in Tests/test_imagemath.py,
      src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Thu, 20 Oct 2022 11:32:25 -0400

Available diffs

diff from 5.1.0-1ubuntu0.7 to 5.1.0-1ubuntu0.8 (1.3 KiB)

7.0.0-4ubuntu0.6

Superseded in focal-updates on 2022-12-13

Superseded in focal-security on 2022-12-13

pillow (7.0.0-4ubuntu0.6) focal-security; urgency=medium

  * SECURITY UPDATE: incomplete fix for CVE-2022-22817
    - debian/patches/CVE-2022-22817-2.patch: restrict builtins within
      lambdas for ImageMath.eval in Tests/test_imagemath.py,
      src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Thu, 20 Oct 2022 11:28:59 -0400

Available diffs

diff from 7.0.0-4ubuntu0.5 to 7.0.0-4ubuntu0.6 (1.3 KiB)

9.2.0-1

Superseded in lunar-release on 2022-12-04

Obsolete in kinetic-release on 2023-11-13

Deleted in kinetic-proposed (Reason: Moved to kinetic)

pillow (9.2.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Sun, 17 Jul 2022 13:57:17 +0200

Available diffs

diff from 9.1.1-1 to 9.2.0-1 (252.0 KiB)

9.1.1-1

Superseded in kinetic-release on 2022-07-27

Deleted in kinetic-proposed on 2022-07-29 (Reason: Moved to kinetic)

pillow (9.1.1-1) unstable; urgency=medium

  * New upstream version.
    - CVE-2022-30595: When reading past the end of a TGA scan line,
      reduce bytes left.
    - Do not open images with zero or negative height (#6269).

 -- Matthias Klose <email address hidden>  Fri, 27 May 2022 11:56:13 +0200

Available diffs

diff from 9.0.1-1build1 (in Ubuntu) to 9.1.1-1 (178.2 KiB)
diff from 9.1.0-1 to 9.1.1-1 (3.2 KiB)

9.1.0-1

Superseded in kinetic-proposed on 2022-05-27

pillow (9.1.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Mon, 04 Apr 2022 13:08:08 +0200

9.0.1-1build1

Superseded in kinetic-release on 2022-06-08

Published in jammy-release on 2022-04-01

Deleted in jammy-proposed (Reason: Moved to jammy)

pillow (9.0.1-1build1) jammy; urgency=medium

  * No-change rebuild with Python 3.10 only.

 -- Matthias Klose <email address hidden>  Thu, 17 Mar 2022 18:50:53 +0100

Available diffs

diff from 9.0.1-1 (in Debian) to 9.0.1-1build1 (308 bytes)

9.0.1-1

Superseded in jammy-release on 2022-04-01

Deleted in jammy-proposed on 2022-04-02 (Reason: Moved to jammy)

pillow (9.0.1-1) unstable; urgency=medium

  * New upstream version.
  * Fix documentation build error with Python 3.10 (Heinrich Schuchardt).

 -- Matthias Klose <email address hidden>  Fri, 18 Feb 2022 01:07:13 +0100

Available diffs

diff from 9.0.0-1 to 9.0.1-1 (3.5 KiB)
diff from 9.0.0-1ubuntu1 (in Ubuntu) to 9.0.1-1 (3.7 KiB)

9.0.0-1ubuntu1

Superseded in jammy-proposed on 2022-02-18

pillow (9.0.0-1ubuntu1) jammy; urgency=medium

  * Fix documentation build error (LP: #1960263)

 -- Heinrich Schuchardt <email address hidden>  Tue, 15 Feb 2022 10:13:08 +0100

Available diffs

diff from 9.0.0-1build1 to 9.0.0-1ubuntu1 (745 bytes)

9.0.0-1build1

Superseded in jammy-proposed on 2022-02-15

pillow (9.0.0-1build1) jammy; urgency=medium

  * No-change rebuild against latest libwebp

 -- Jeremy Bicha <email address hidden>  Tue, 01 Feb 2022 09:26:48 -0500

Available diffs

diff from 9.0.0-1 (in Debian) to 9.0.0-1build1 (311 bytes)

5.1.0-1ubuntu0.7

Superseded in bionic-updates on 2022-10-24

Superseded in bionic-security on 2022-10-24

pillow (5.1.0-1ubuntu0.7) bionic-security; urgency=medium

  * SECURITY UPDATE: regular expression DoS
    - debian/patches/CVE-2021-23437.patch: raise ValueError if color
      specifier is too long in Tests/test_imagecolor.py,
      src/PIL/ImageColor.py.
    - CVE-2021-23437
  * SECURITY UPDATE: Dos via buffer overflow
    - debian/patches/CVE-2021-34552.patch: limit sprintf modes to 10
      characters in src/libImaging/Convert.c.
    - CVE-2021-34552
  * SECURITY UPDATE: improper initialization
    - debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
      in src/path.c.
    - CVE-2022-22815
  * SECURITY UPDATE: buffer over-read during initialization
    - debian/patches/CVE-2022-22816.patch: handle case where path count is
      zero in src/path.c.
    - CVE-2022-22816
  * SECURITY UPDATE: evaluation of arbitrary expressions
    - debian/patches/CVE-2022-22817.patch: restrict builtins for
      ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Wed, 12 Jan 2022 13:21:48 -0500

Available diffs

diff from 5.1.0-1ubuntu0.6 to 5.1.0-1ubuntu0.7 (2.9 KiB)

8.1.2-1ubuntu0.2

Obsolete in hirsute-updates on 2022-07-23

Obsolete in hirsute-security on 2022-07-23

pillow (8.1.2-1ubuntu0.2) hirsute-security; urgency=medium

  * SECURITY UPDATE: regular expression DoS
    - debian/patches/CVE-2021-23437.patch: raise ValueError if color
      specifier is too long in Tests/test_imagecolor.py,
      src/PIL/ImageColor.py.
    - CVE-2021-23437
  * SECURITY UPDATE: Dos via buffer overflow
    - debian/patches/CVE-2021-34552.patch: limit sprintf modes to 10
      characters in src/libImaging/Convert.c.
    - CVE-2021-34552
  * SECURITY UPDATE: improper initialization
    - debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
      in Tests/test_imagepath.py, src/path.c.
    - CVE-2022-22815
  * SECURITY UPDATE: buffer over-read during initialization
    - debian/patches/CVE-2022-22816.patch: handle case where path count is
      zero in Tests/test_imagepath.py, src/path.c.
    - CVE-2022-22816
  * SECURITY UPDATE: evaluation of arbitrary expressions
    - debian/patches/CVE-2022-22817.patch: restrict builtins for
      ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Wed, 12 Jan 2022 12:54:47 -0500

Available diffs

diff from 8.1.2-1ubuntu0.1 to 8.1.2-1ubuntu0.2 (3.1 KiB)

8.1.2+dfsg-0.3ubuntu0.1

Obsolete in impish-updates on 2022-07-23

Obsolete in impish-security on 2022-07-23

pillow (8.1.2+dfsg-0.3ubuntu0.1) impish-security; urgency=medium

  * SECURITY UPDATE: regular expression DoS
    - debian/patches/CVE-2021-23437.patch: raise ValueError if color
      specifier is too long in Tests/test_imagecolor.py,
      src/PIL/ImageColor.py.
    - CVE-2021-23437
  * SECURITY UPDATE: improper initialization
    - debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
      in Tests/test_imagepath.py, src/path.c.
    - CVE-2022-22815
  * SECURITY UPDATE: buffer over-read during initialization
    - debian/patches/CVE-2022-22816.patch: handle case where path count is
      zero in Tests/test_imagepath.py, src/path.c.
    - CVE-2022-22816
  * SECURITY UPDATE: evaluation of arbitrary expressions
    - debian/patches/CVE-2022-22817.patch: restrict builtins for
      ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Wed, 12 Jan 2022 12:49:56 -0500

Available diffs

diff from 8.1.2+dfsg-0.3 (in Debian) to 8.1.2+dfsg-0.3ubuntu0.1 (2.9 KiB)

7.0.0-4ubuntu0.5

Superseded in focal-updates on 2022-10-24

Superseded in focal-security on 2022-10-24

pillow (7.0.0-4ubuntu0.5) focal-security; urgency=medium

  * SECURITY UPDATE: regular expression DoS
    - debian/patches/CVE-2021-23437.patch: raise ValueError if color
      specifier is too long in Tests/test_imagecolor.py,
      src/PIL/ImageColor.py.
    - CVE-2021-23437
  * SECURITY UPDATE: Dos via buffer overflow
    - debian/patches/CVE-2021-34552.patch: limit sprintf modes to 10
      characters in src/libImaging/Convert.c.
    - CVE-2021-34552
  * SECURITY UPDATE: improper initialization
    - debian/patches/CVE-2022-22815.patch: initialize coordinates to zero
      in src/path.c.
    - CVE-2022-22815
  * SECURITY UPDATE: buffer over-read during initialization
    - debian/patches/CVE-2022-22816.patch: handle case where path count is
      zero in src/path.c.
    - CVE-2022-22816
  * SECURITY UPDATE: evaluation of arbitrary expressions
    - debian/patches/CVE-2022-22817.patch: restrict builtins for
      ImageMath.eval in Tests/test_imagemath.py, src/PIL/ImageMath.py.
    - CVE-2022-22817

 -- Marc Deslauriers <email address hidden>  Wed, 12 Jan 2022 13:05:20 -0500

Available diffs

diff from 7.0.0-4ubuntu0.4 to 7.0.0-4ubuntu0.5 (2.9 KiB)

9.0.0-1

Superseded in jammy-release on 2022-02-20

Deleted in jammy-proposed on 2022-02-22 (Reason: Moved to jammy)

pillow (9.0.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Mon, 10 Jan 2022 10:52:08 +0100

Available diffs

diff from 8.1.2+dfsg-0.3 to 9.0.0-1 (505.0 KiB)
diff from 8.4.0-1 to 9.0.0-1 (61.7 KiB)

8.4.0-1

Superseded in jammy-proposed on 2022-01-10

pillow (8.4.0-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Thu, 25 Nov 2021 13:17:45 +0100

Available diffs

diff from 8.3.2-1 to 8.4.0-1 (34.7 KiB)

8.1.2+dfsg-0.3build1

Superseded in jammy-proposed on 2021-10-18

pillow (8.1.2+dfsg-0.3build1) jammy; urgency=medium

  * No-change rebuild to add python3.10.

 -- Matthias Klose <email address hidden>  Sat, 16 Oct 2021 21:59:13 +0200

Available diffs

diff from 8.1.2+dfsg-0.3 (in Debian) to 8.1.2+dfsg-0.3build1 (344 bytes)

8.3.2-1

Superseded in jammy-proposed on 2021-11-25

pillow (8.3.2-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards version.

 -- Matthias Klose <email address hidden>  Mon, 11 Oct 2021 15:35:03 +0200

Available diffs

diff from 8.1.2+dfsg-0.3build1 (in Ubuntu) to 8.3.2-1 (462.7 KiB)

8.1.2+dfsg-0.3

Superseded in jammy-release on 2022-01-28

Obsolete in impish-release on 2022-07-23

Deleted in impish-proposed (Reason: Moved to impish)

pillow (8.1.2+dfsg-0.3) unstable; urgency=high

  * Non-maintainer upload by the Security Team.
  * Fix "CVE-2021-34552 - buffer overflow in Convert.c. Replace sprintf with
    snprintf. Backport upstream change from 8.3 to 8.1. (Closes: #991293)

 -- Neil Williams <email address hidden>  Tue, 20 Jul 2021 06:42:31 +0100

Available diffs

diff from 8.1.2+dfsg-0.2 to 8.1.2+dfsg-0.3 (1.1 KiB)

8.1.2+dfsg-0.2

Superseded in impish-release on 2021-07-21

Deleted in impish-proposed on 2021-07-22 (Reason: Moved to impish)

pillow (8.1.2+dfsg-0.2) unstable; urgency=medium

  * Non-maintainer upload.
  * Cherrypick security fixes from 8.2:
    - CVE-2021-25287 / CVE-2021-25288 / CVE-2021-28675 / CVE-2021-28676
      CVE-2021-28677 / CVE-2021-28678 (Closes: #989062)

 -- Moritz Muehlenhoff <email address hidden>  Sun, 13 Jun 2021 18:11:04 +0200

Available diffs

diff from 8.1.2+dfsg-0.1ubuntu1 (in Ubuntu) to 8.1.2+dfsg-0.2 (4.8 KiB)

7.0.0-4ubuntu0.4

Superseded in focal-updates on 2022-01-13

Superseded in focal-security on 2022-01-13

pillow (7.0.0-4ubuntu0.4) focal-security; urgency=medium

  * SECURITY UPDATE: OOB read in Jpeg2KDecode
    - debian/patches/CVE-2021-25287_8.patch: handle different widths for
      each band in src/libImaging/Jpeg2KDecode.c.
    - CVE-2021-25287
    - CVE-2021-25288
  * SECURITY UPDATE: DOS in PsdImagePlugin
    - debian/patches/CVE-2021-28675.patch: sanity check the number of
      input layers in Tests/test_decompression_bomb.py,
      Tests/test_file_apng.py, Tests/test_file_blp.py,
      Tests/test_file_tiff.py, src/PIL/ImageFile.py,
      src/PIL/PsdImagePlugin.py.
    - CVE-2021-28675
  * SECURITY UPDATE: FLI DOS
    - debian/patches/CVE-2021-28676.patch: check the block advance in
      src/libImaging/FliDecode.c.
    - CVE-2021-28676
  * SECURITY UPDATE: EPS DOS on _open
    - debian/patches/CVE-2021-28677.patch: properly handle line endings in
      src/PIL/EpsImagePlugin.py.
    - CVE-2021-28677
  * SECURITY UPDATE: BLP DOS
    - debian/patches/CVE-2021-28678.patch: check that reads return data in
      src/PIL/BlpImagePlugin.py.
    - CVE-2021-28678

 -- Marc Deslauriers <email address hidden>  Tue, 18 May 2021 07:19:28 -0400

Available diffs

diff from 7.0.0-4ubuntu0.3 to 7.0.0-4ubuntu0.4 (6.2 KiB)

8.1.2-1ubuntu0.1

Superseded in hirsute-updates on 2022-01-13

Superseded in hirsute-security on 2022-01-13

pillow (8.1.2-1ubuntu0.1) hirsute-security; urgency=medium

  * SECURITY UPDATE: OOB read in Jpeg2KDecode
    - debian/patches/CVE-2021-25287_8.patch: handle different widths for
      each band in src/libImaging/Jpeg2KDecode.c.
    - CVE-2021-25287
    - CVE-2021-25288
  * SECURITY UPDATE: DOS in PsdImagePlugin
    - debian/patches/CVE-2021-28675.patch: sanity check the number of
      input layers in Tests/test_decompression_bomb.py,
      Tests/test_file_apng.py, Tests/test_file_blp.py,
      Tests/test_file_tiff.py, src/PIL/ImageFile.py,
      src/PIL/PsdImagePlugin.py.
    - CVE-2021-28675
  * SECURITY UPDATE: FLI DOS
    - debian/patches/CVE-2021-28676.patch: check the block advance in
      src/libImaging/FliDecode.c.
    - CVE-2021-28676
  * SECURITY UPDATE: EPS DOS on _open
    - debian/patches/CVE-2021-28677.patch: properly handle line endings in
      src/PIL/EpsImagePlugin.py.
    - CVE-2021-28677
  * SECURITY UPDATE: BLP DOS
    - debian/patches/CVE-2021-28678.patch: check that reads return data in
      src/PIL/BlpImagePlugin.py.
    - CVE-2021-28678

 -- Marc Deslauriers <email address hidden>  Tue, 18 May 2021 07:09:08 -0400

Available diffs

diff from 8.1.2-1 (in Debian) to 8.1.2-1ubuntu0.1 (6.6 KiB)

7.2.0-1ubuntu0.3

Obsolete in groovy-updates on 2021-12-22

Obsolete in groovy-security on 2021-12-22

pillow (7.2.0-1ubuntu0.3) groovy-security; urgency=medium

  * SECURITY UPDATE: OOB read in Jpeg2KDecode
    - debian/patches/CVE-2021-25287_8.patch: handle different widths for
      each band in src/libImaging/Jpeg2KDecode.c.
    - CVE-2021-25287
    - CVE-2021-25288
  * SECURITY UPDATE: DOS in PsdImagePlugin
    - debian/patches/CVE-2021-28675.patch: sanity check the number of
      input layers in Tests/test_decompression_bomb.py,
      Tests/test_file_apng.py, Tests/test_file_blp.py,
      Tests/test_file_tiff.py, src/PIL/ImageFile.py,
      src/PIL/PsdImagePlugin.py.
    - CVE-2021-28675
  * SECURITY UPDATE: FLI DOS
    - debian/patches/CVE-2021-28676.patch: check the block advance in
      src/libImaging/FliDecode.c.
    - CVE-2021-28676
  * SECURITY UPDATE: EPS DOS on _open
    - debian/patches/CVE-2021-28677.patch: properly handle line endings in
      src/PIL/EpsImagePlugin.py.
    - CVE-2021-28677
  * SECURITY UPDATE: BLP DOS
    - debian/patches/CVE-2021-28678.patch: check that reads return data in
      src/PIL/BlpImagePlugin.py.
    - CVE-2021-28678

 -- Marc Deslauriers <email address hidden>  Tue, 18 May 2021 07:10:06 -0400

Available diffs

diff from 7.2.0-1ubuntu0.2 to 7.2.0-1ubuntu0.3 (6.4 KiB)

5.1.0-1ubuntu0.6

Superseded in bionic-updates on 2022-01-13

Superseded in bionic-security on 2022-01-13

pillow (5.1.0-1ubuntu0.6) bionic-security; urgency=medium

  * SECURITY UPDATE: OOB read in Jpeg2KDecode
    - debian/patches/CVE-2021-25287_8.patch: handle different widths for
      each band in src/libImaging/Jpeg2KDecode.c.
    - CVE-2021-25287
    - CVE-2021-25288
  * SECURITY UPDATE: DOS in PsdImagePlugin
    - debian/patches/CVE-2021-28675.patch: sanity check the number of
      input layers in Tests/test_decompression_bomb.py,
      Tests/test_file_apng.py, Tests/test_file_blp.py,
      Tests/test_file_tiff.py, src/PIL/ImageFile.py,
      src/PIL/PsdImagePlugin.py.
    - CVE-2021-28675
  * SECURITY UPDATE: FLI DOS
    - debian/patches/CVE-2021-28676.patch: check the block advance in
      src/libImaging/FliDecode.c.
    - CVE-2021-28676
  * SECURITY UPDATE: EPS DOS on _open
    - debian/patches/CVE-2021-28677.patch: properly handle line endings in
      src/PIL/EpsImagePlugin.py.
    - CVE-2021-28677
  * SECURITY UPDATE: BLP DOS
    - debian/patches/CVE-2021-28678.patch: check that reads return data in
      src/PIL/BlpImagePlugin.py.
    - CVE-2021-28678

 -- Marc Deslauriers <email address hidden>  Tue, 18 May 2021 07:33:36 -0400

Available diffs

diff from 5.1.0-1ubuntu0.5 to 5.1.0-1ubuntu0.6 (6.3 KiB)

8.1.2+dfsg-0.1ubuntu1

Superseded in impish-release on 2021-06-19

Deleted in impish-proposed on 2021-06-21 (Reason: Moved to impish)

pillow (8.1.2+dfsg-0.1ubuntu1) impish; urgency=medium

  * SECURITY UPDATE: OOB read in Jpeg2KDecode
    - debian/patches/CVE-2021-25287_8.patch: handle different widths for
      each band in src/libImaging/Jpeg2KDecode.c.
    - CVE-2021-25287
    - CVE-2021-25288
  * SECURITY UPDATE: DOS in PsdImagePlugin
    - debian/patches/CVE-2021-28675.patch: sanity check the number of
      input layers in Tests/test_decompression_bomb.py,
      Tests/test_file_apng.py, Tests/test_file_blp.py,
      Tests/test_file_tiff.py, src/PIL/ImageFile.py,
      src/PIL/PsdImagePlugin.py.
    - CVE-2021-28675
  * SECURITY UPDATE: FLI DOS
    - debian/patches/CVE-2021-28676.patch: check the block advance in
      src/libImaging/FliDecode.c.
    - CVE-2021-28676
  * SECURITY UPDATE: EPS DOS on _open
    - debian/patches/CVE-2021-28677.patch: properly handle line endings in
      src/PIL/EpsImagePlugin.py.
    - CVE-2021-28677
  * SECURITY UPDATE: BLP DOS
    - debian/patches/CVE-2021-28678.patch: check that reads return data in
      src/PIL/BlpImagePlugin.py.
    - CVE-2021-28678

 -- Marc Deslauriers <email address hidden>  Tue, 18 May 2021 07:02:45 -0400

Available diffs

diff from 8.1.2+dfsg-0.1 (in Debian) to 8.1.2+dfsg-0.1ubuntu1 (6.6 KiB)

8.1.2+dfsg-0.1

Superseded in impish-release on 2021-05-27

Deleted in impish-proposed on 2021-05-28 (Reason: Moved to impish)

pillow (8.1.2+dfsg-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Repack for DFSG compliance and update d/copyright. Closes: #952899.
  * Update d/watch for +dfsg repack.

 -- Romain Porte <email address hidden>  Sat, 24 Apr 2021 15:51:24 +0200

Available diffs

diff from 8.1.2-1 to 8.1.2+dfsg-0.1 (4.6 KiB)

3.1.2-0ubuntu1.6

Published in xenial-updates on 2021-03-11

Published in xenial-security on 2021-03-11

pillow (3.1.2-0ubuntu1.6) xenial-security; urgency=medium

  * SECURITY UPDATE: negative-offset memcpy with an invalid size
    - debian/patches/CVE-2021-25290.patch: add extra check to
      libImaging/TiffDecode.c.
    - CVE-2021-25290
  * SECURITY UPDATE: DoS via invalid reported size
    - debian/patches/CVE-2021-2792x.patch: check reported sizes in
      PIL/IcnsImagePlugin.py, PIL/IcoImagePlugin.py.
    - CVE-2021-27922
    - CVE-2021-27923

 -- Marc Deslauriers <email address hidden>  Thu, 11 Mar 2021 07:51:05 -0500

Available diffs

diff from 3.1.2-0ubuntu1.5 to 3.1.2-0ubuntu1.6 (2.1 KiB)

7.0.0-4ubuntu0.3

Superseded in focal-updates on 2021-05-19

Superseded in focal-security on 2021-05-19

pillow (7.0.0-4ubuntu0.3) focal-security; urgency=medium

  * SECURITY UPDATE: insufficient fix for CVE-2020-35654
    - debian/patches/CVE-2021-25289.patch: improve return code check in
      src/libImaging/TiffDecode.c.
    - CVE-2021-25289
  * SECURITY UPDATE: negative-offset memcpy with an invalid size
    - debian/patches/CVE-2021-25290.patch: add extra check to
      src/libImaging/TiffDecode.c.
    - CVE-2021-25290
  * SECURITY UPDATE: invalid tile boundaries could lead to an OOB Read
    - debian/patches/CVE-2021-25291.patch: check tile validity in
      src/libImaging/TiffDecode.c.
    - CVE-2021-25291
  * SECURITY UPDATE: DoS via backtrack regex
    - debian/patches/CVE-2021-25292.patch: use more specific regex in
      src/PIL/PdfParser.py.
    - CVE-2021-25292
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2021-25293.patch: add more checks to
      src/libImaging/SgiRleDecode.c.
    - CVE-2021-25293
  * SECURITY UPDATE: DoS via invalid reported size
    - debian/patches/CVE-2021-2792x.patch: check reported sizes in
      src/PIL/BlpImagePlugin.py, src/PIL/IcnsImagePlugin.py,
      src/PIL/IcoImagePlugin.py.
    - CVE-2021-27921
    - CVE-2021-27922
    - CVE-2021-27923

 -- Marc Deslauriers <email address hidden>  Wed, 10 Mar 2021 12:48:44 -0500

Available diffs

diff from 7.0.0-4ubuntu0.2 to 7.0.0-4ubuntu0.3 (5.8 KiB)

7.2.0-1ubuntu0.2

Superseded in groovy-updates on 2021-05-19

Superseded in groovy-security on 2021-05-19

pillow (7.2.0-1ubuntu0.2) groovy-security; urgency=medium

  * SECURITY UPDATE: insufficient fix for CVE-2020-35654
    - debian/patches/CVE-2021-25289.patch: improve return code check in
      src/libImaging/TiffDecode.c.
    - CVE-2021-25289
  * SECURITY UPDATE: negative-offset memcpy with an invalid size
    - debian/patches/CVE-2021-25290.patch: add extra check to
      src/libImaging/TiffDecode.c.
    - CVE-2021-25290
  * SECURITY UPDATE: invalid tile boundaries could lead to an OOB Read
    - debian/patches/CVE-2021-25291.patch: check tile validity in
      src/libImaging/TiffDecode.c.
    - CVE-2021-25291
  * SECURITY UPDATE: DoS via backtrack regex
    - debian/patches/CVE-2021-25292.patch: use more specific regex in
      src/PIL/PdfParser.py.
    - CVE-2021-25292
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2021-25293.patch: add more checks to
      src/libImaging/SgiRleDecode.c.
    - CVE-2021-25293
  * SECURITY UPDATE: DoS via invalid reported size
    - debian/patches/CVE-2021-2792x.patch: check reported sizes in
      src/PIL/BlpImagePlugin.py, src/PIL/IcnsImagePlugin.py,
      src/PIL/IcoImagePlugin.py.
    - CVE-2021-27921
    - CVE-2021-27922
    - CVE-2021-27923

 -- Marc Deslauriers <email address hidden>  Wed, 10 Mar 2021 12:41:13 -0500

Available diffs

diff from 7.2.0-1ubuntu0.1 to 7.2.0-1ubuntu0.2 (5.8 KiB)

5.1.0-1ubuntu0.5

Superseded in bionic-updates on 2021-05-19

Superseded in bionic-security on 2021-05-19

pillow (5.1.0-1ubuntu0.5) bionic-security; urgency=medium

  * SECURITY UPDATE: negative-offset memcpy with an invalid size
    - debian/patches/CVE-2021-25290.patch: add extra check to
      src/libImaging/TiffDecode.c.
    - CVE-2021-25290
  * SECURITY UPDATE: DoS via backtrack regex
    - debian/patches/CVE-2021-25292.patch: use more specific regex in
      src/PIL/PdfParser.py.
    - CVE-2021-25292
  * SECURITY UPDATE: Out of Bounds Read
    - debian/patches/CVE-2021-25293.patch: add more checks to
      src/libImaging/SgiRleDecode.c.
    - CVE-2021-25293
  * SECURITY UPDATE: DoS via invalid reported size
    - debian/patches/CVE-2021-2792x.patch: check reported sizes in
      src/PIL/BlpImagePlugin.py, src/PIL/IcnsImagePlugin.py,
      src/PIL/IcoImagePlugin.py.
    - CVE-2021-27921
    - CVE-2021-27922
    - CVE-2021-27923

 -- Marc Deslauriers <email address hidden>  Wed, 10 Mar 2021 13:01:32 -0500

Available diffs

diff from 5.1.0-1ubuntu0.4 to 5.1.0-1ubuntu0.5 (4.9 KiB)

8.1.2-1

Superseded in impish-release on 2021-05-09

Obsolete in hirsute-release on 2022-07-23

Deleted in hirsute-proposed on 2022-07-24 (Reason: Moved to hirsute)

pillow (8.1.2-1) unstable; urgency=high

  * New upstream version.
    - Fix Memory DOS in BLP (CVE-2021-27921), ICNS (CVE-2021-27922)
      and ICO (CVE-2021-27923) Image Plugins.

 -- Matthias Klose <email address hidden>  Tue, 09 Mar 2021 08:12:51 +0100

Available diffs

diff from 8.1.1-1 to 8.1.2-1 (4.2 KiB)

8.1.1-1

Superseded in hirsute-release on 2021-03-10

Deleted in hirsute-proposed on 2021-03-11 (Reason: moved to Release)

pillow (8.1.1-1) unstable; urgency=high

  * New upstream version.
    - Use more specific regex chars to prevent ReDoS. CVE-2021-25292.
    - Fix OOB Read in TiffDecode.c, and check the tile validity before reading.
      CVE-2021-25291.
    - Fix negative size read in TiffDecode.c. CVE-2021-25290.
    - Fix OOB read in SgiRleDecode.c. CVE-2021-25293.
    - Incorrect error code checking in TiffDecode.c. CVE-2021-25289.

 -- Matthias Klose <email address hidden>  Thu, 04 Mar 2021 07:13:48 +0100

Available diffs

diff from 8.1.0-1 to 8.1.1-1 (5.9 KiB)

3.1.2-0ubuntu1.5

Superseded in xenial-updates on 2021-03-11

Superseded in xenial-security on 2021-03-11

pillow (3.1.2-0ubuntu1.5) xenial-security; urgency=medium

  * SECURITY UPDATE: buffer over-read via PCX file
    - debian/patches/CVE-2020-35653.patch: don't trust the image to specify
      a buffer size in PIL/PcxImagePlugin.py, removed failing test in
      Tests/test_image.py.
    - CVE-2020-35653

 -- Marc Deslauriers <email address hidden>  Wed, 13 Jan 2021 10:51:58 -0500

Available diffs

diff from 3.1.2-0ubuntu1.4 to 3.1.2-0ubuntu1.5 (1.4 KiB)

5.1.0-1ubuntu0.4

Superseded in bionic-updates on 2021-03-11

Superseded in bionic-security on 2021-03-11

pillow (5.1.0-1ubuntu0.4) bionic-security; urgency=medium

  * SECURITY UPDATE: buffer over-read via PCX file
    - debian/patches/CVE-2020-35653.patch: don't trust the image to specify
      a buffer size in src/PIL/PcxImagePlugin.py.
    - CVE-2020-35653
  * SECURITY UPDATE: buffer over-read via SGI RLE image file
    - debian/patches/CVE-2020-35655-1.patch: add checks to
      src/libImaging/SgiRleDecode.c.
    - debian/patches/CVE-2020-35655-2.patch: rework error flags in
      src/libImaging/SgiRleDecode.c.
    - CVE-2020-35655

 -- Marc Deslauriers <email address hidden>  Wed, 13 Jan 2021 10:51:02 -0500

Available diffs

diff from 5.1.0-1ubuntu0.3 to 5.1.0-1ubuntu0.4 (2.5 KiB)

7.0.0-4ubuntu0.2

Superseded in focal-updates on 2021-03-11

Superseded in focal-security on 2021-03-11

pillow (7.0.0-4ubuntu0.2) focal-security; urgency=medium

  * SECURITY UPDATE: buffer over-read via PCX file
    - debian/patches/CVE-2020-35653.patch: don't trust the image to specify
      a buffer size in src/PIL/PcxImagePlugin.py.
    - CVE-2020-35653
  * SECURITY UPDATE: heap overflow via YCbCr files
    - debian/patches/CVE-2020-35654-1.patch: fix tiff comparison warnings
      in src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-35654-2.patch: fix OOB write in
      src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-35654-3.patch: rework ReadTile in
      src/libImaging/TiffDecode.c.
    - CVE-2020-35654
  * SECURITY UPDATE: buffer over-read via SGI RLE image file
    - debian/patches/CVE-2020-35655-1.patch: add checks to
      src/libImaging/SgiRleDecode.c.
    - debian/patches/CVE-2020-35655-2.patch: rework error flags in
      src/libImaging/SgiRleDecode.c.
    - CVE-2020-35655

 -- Marc Deslauriers <email address hidden>  Wed, 13 Jan 2021 09:55:14 -0500

Available diffs

diff from 7.0.0-4ubuntu0.1 to 7.0.0-4ubuntu0.2 (7.3 KiB)

7.2.0-1ubuntu0.1

Superseded in groovy-updates on 2021-03-11

Superseded in groovy-security on 2021-03-11

pillow (7.2.0-1ubuntu0.1) groovy-security; urgency=medium

  * SECURITY UPDATE: buffer over-read via PCX file
    - debian/patches/CVE-2020-35653.patch: don't trust the image to specify
      a buffer size in src/PIL/PcxImagePlugin.py.
    - CVE-2020-35653
  * SECURITY UPDATE: heap overflow via YCbCr files
    - debian/patches/CVE-2020-35654-1.patch: fix tiff comparison warnings
      in src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-35654-2.patch: fix OOB write in
      src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-35654-3.patch: rework ReadTile in
      src/libImaging/TiffDecode.c.
    - CVE-2020-35654
  * SECURITY UPDATE: buffer over-read via SGI RLE image file
    - debian/patches/CVE-2020-35655-1.patch: add checks to
      src/libImaging/SgiRleDecode.c.
    - debian/patches/CVE-2020-35655-2.patch: rework error flags in
      src/libImaging/SgiRleDecode.c.
    - CVE-2020-35655

 -- Marc Deslauriers <email address hidden>  Wed, 13 Jan 2021 09:35:02 -0500

Available diffs

diff from 7.2.0-1 (in Debian) to 7.2.0-1ubuntu0.1 (7.6 KiB)

8.1.0-1

Superseded in hirsute-release on 2021-03-05

Deleted in hirsute-proposed on 2021-03-06 (Reason: moved to Release)

pillow (8.1.0-1) unstable; urgency=medium

  * New upstream version.
  * Bump standards and debhelper versions.

 -- Matthias Klose <email address hidden>  Wed, 06 Jan 2021 13:18:02 +0100

Available diffs

diff from 8.0.1-1build1 (in Ubuntu) to 8.1.0-1 (57.4 KiB)

8.0.1-1build1

Superseded in hirsute-release on 2021-01-07

Deleted in hirsute-proposed on 2021-01-08 (Reason: moved to Release)

pillow (8.0.1-1build1) hirsute; urgency=medium

  * No-change rebuild to drop python3.8 extensions.

 -- Matthias Klose <email address hidden>  Mon, 07 Dec 2020 18:45:05 +0100

Available diffs

diff from 8.0.1-1 (in Debian) to 8.0.1-1build1 (313 bytes)

8.0.1-1

Superseded in hirsute-release on 2020-12-15

Deleted in hirsute-proposed on 2020-12-16 (Reason: moved to Release)

pillow (8.0.1-1) unstable; urgency=medium

  * New upstream version.

 -- Matthias Klose <email address hidden>  Thu, 29 Oct 2020 20:02:10 +0100

Available diffs

diff from 7.2.0-1build1 (in Ubuntu) to 8.0.1-1 (153.1 KiB)

7.2.0-1build1

Superseded in hirsute-release on 2020-11-16

Deleted in hirsute-proposed on 2020-11-17 (Reason: moved to Release)

pillow (7.2.0-1build1) hirsute; urgency=medium

  * No-change rebuild to build with python3.9 as supported.

 -- Matthias Klose <email address hidden>  Sat, 24 Oct 2020 12:44:06 +0200

Available diffs

diff from 7.2.0-1 (in Debian) to 7.2.0-1build1 (318 bytes)

7.0.0-4ubuntu0.1

Superseded in focal-updates on 2021-01-18

Superseded in focal-security on 2021-01-18

pillow (7.0.0-4ubuntu0.1) focal-security; urgency=medium

  * SECURITY UPDATE: multiple out of bounds reads
    - debian/patches/CVE-2020-10177-1.patch: fix issue in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-2.patch: refactor to macro in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
      in src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-7.patch: fix comments in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-8.patch: additional FLI check in
      src/libImaging/FliDecode.c.
    - CVE-2020-10177
  * SECURITY UPDATE: out of bounds read with PCX files
    - debian/patches/CVE-2020-10378.patch: fix OOB Access in
      src/libImaging/PcxDecode.c.
    - CVE-2020-10378
  * SECURITY UPDATE: two buffer overflows
    - debian/patches/CVE-2020-10379-1.patch: ensure that Tiff's concept of
      Strip and Tilesize matches Pillow's in src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-10379-2.patch: avoid uninitialized read in
      src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-10379-3.patch: fix typos in
      src/libImaging/TiffDecode.c.
    - CVE-2020-10379
  * SECURITY UPDATE: out-of-bounds read via JP2 file
    - debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
      src/libImaging/Jpeg2KDecode.c.
    - debian/patches/CVE-2020-10994-2.patch: fix typo in
      src/libImaging/Jpeg2KDecode.c.
    - CVE-2020-10994
  * SECURITY UPDATE: out-of-bounds read via SGI file
    - debian/patches/CVE-2020-11538.patch: track number of pixels, not the
      number of runs in src/libImaging/SgiRleDecode.c.
    - CVE-2020-11538

 -- Marc Deslauriers <email address hidden>  Tue, 07 Jul 2020 13:14:10 -0400

Available diffs

diff from 7.0.0-4build1 (in Ubuntu) to 7.0.0-4ubuntu0.1 (6.5 KiB)

7.2.0-1

Superseded in hirsute-release on 2020-10-25

Obsolete in groovy-release on 2021-12-22

Deleted in groovy-proposed on 2021-12-23 (Reason: moved to Release)

pillow (7.2.0-1) unstable; urgency=medium

  * New upstream version.
  * Update debian/copyright, partially addresses #952899.
    - Mention contributors.
    - Add copyright information for fonts.
  * Bump debhelper version.

 -- Matthias Klose <email address hidden>  Thu, 16 Jul 2020 13:42:51 +0200

Available diffs

diff from 7.0.0-4ubuntu1 (in Ubuntu) to 7.2.0-1 (398.4 KiB)

5.1.0-1ubuntu0.3

Superseded in bionic-updates on 2021-01-18

Superseded in bionic-security on 2021-01-18

pillow (5.1.0-1ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: multiple out of bounds reads
    - debian/patches/CVE-2020-10177-1.patch: fix issue in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-2.patch: refactor to macro in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
      in src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-7.patch: fix comments in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-8.patch: additional FLI check in
      src/libImaging/FliDecode.c.
    - CVE-2020-10177
  * SECURITY UPDATE: out of bounds read with PCX files
    - debian/patches/CVE-2020-10378.patch: fix OOB Access in
      src/libImaging/PcxDecode.c.
    - CVE-2020-10378
  * SECURITY UPDATE: out-of-bounds read via JP2 file
    - debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
      src/libImaging/Jpeg2KDecode.c.
    - debian/patches/CVE-2020-10994-2.patch: fix typo in
      src/libImaging/Jpeg2KDecode.c.
    - CVE-2020-10994
  * SECURITY UPDATE: out-of-bounds read via SGI file
    - debian/patches/CVE-2020-11538.patch: track number of pixels, not the
      number of runs in src/libImaging/SgiRleDecode.c.
    - CVE-2020-11538

 -- Marc Deslauriers <email address hidden>  Tue, 07 Jul 2020 13:35:30 -0400

Available diffs

diff from 5.1.0-1ubuntu0.2 to 5.1.0-1ubuntu0.3 (5.2 KiB)

3.1.2-0ubuntu1.4

Superseded in xenial-updates on 2021-01-18

Superseded in xenial-security on 2021-01-18

pillow (3.1.2-0ubuntu1.4) xenial-security; urgency=medium

  * SECURITY UPDATE: multiple out of bounds reads
    - debian/patches/CVE-2020-10177-1.patch: fix issue in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-2.patch: refactor to macro in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
      in src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-7.patch: fix comments in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-8.patch: additional FLI check in
      src/libImaging/FliDecode.c.
    - CVE-2020-10177
  * SECURITY UPDATE: out of bounds read with PCX files
    - debian/patches/CVE-2020-10378.patch: fix OOB Access in
      src/libImaging/PcxDecode.c.
    - CVE-2020-10378
  * SECURITY UPDATE: out-of-bounds read via JP2 file
    - debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
      src/libImaging/Jpeg2KDecode.c.
    - debian/patches/CVE-2020-10994-2.patch: fix typo in
      src/libImaging/Jpeg2KDecode.c.
    - CVE-2020-10994

 -- Marc Deslauriers <email address hidden>  Tue, 07 Jul 2020 13:43:43 -0400

Available diffs

diff from 3.1.2-0ubuntu1.3 to 3.1.2-0ubuntu1.4 (4.8 KiB)

7.0.0-4ubuntu1

Superseded in groovy-release on 2020-07-17

Deleted in groovy-proposed on 2020-07-19 (Reason: moved to Release)

pillow (7.0.0-4ubuntu1) groovy; urgency=medium

  * SECURITY UPDATE: multiple out of bounds reads
    - debian/patches/CVE-2020-10177-1.patch: fix issue in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-2.patch: refactor to macro in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-3.patch: fix OOB Reads in SS2 Chunk in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-4.patch: fix OOB in LC packet in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-5.patch: fix OOB Advance Values in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-6.patch: fix OOB Read in FLI Copy Chunk
      in src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-7.patch: fix comments in
      src/libImaging/FliDecode.c.
    - debian/patches/CVE-2020-10177-8.patch: additional FLI check in
      src/libImaging/FliDecode.c.
    - CVE-2020-10177
  * SECURITY UPDATE: out of bounds read with PCX files
    - debian/patches/CVE-2020-10378.patch: fix OOB Access in
      src/libImaging/PcxDecode.c.
    - CVE-2020-10378
  * SECURITY UPDATE: two buffer overflows
    - debian/patches/CVE-2020-10379-1.patch: ensure that Tiff's concept of
      Strip and Tilesize matches Pillow's in src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-10379-2.patch: avoid uninitialized read in
      src/libImaging/TiffDecode.c.
    - debian/patches/CVE-2020-10379-3.patch: fix typos in
      src/libImaging/TiffDecode.c.
    - CVE-2020-10379
  * SECURITY UPDATE: out-of-bounds read via JP2 file
    - debian/patches/CVE-2020-10994-1.patch: fix for OOB Read in
      src/libImaging/Jpeg2KDecode.c.
    - debian/patches/CVE-2020-10994-2.patch: fix typo in
      src/libImaging/Jpeg2KDecode.c.
    - CVE-2020-10994
  * SECURITY UPDATE: out-of-bounds read via SGI file
    - debian/patches/CVE-2020-11538.patch: track number of pixels, not the
      number of runs in src/libImaging/SgiRleDecode.c.
    - CVE-2020-11538

 -- Marc Deslauriers <email address hidden>  Tue, 07 Jul 2020 13:14:10 -0400

Available diffs

diff from 7.0.0-4build1 to 7.0.0-4ubuntu1 (6.5 KiB)

7.0.0-4build1

Superseded in groovy-release on 2020-07-14

Published in focal-release on 2020-02-21

Deleted in focal-proposed (Reason: moved to Release)

pillow (7.0.0-4build1) focal; urgency=medium

  * No-change rebuild to drop python3.7.

 -- Matthias Klose <email address hidden>  Tue, 18 Feb 2020 10:44:40 +0100

Available diffs

diff from 7.0.0-4 (in Debian) to 7.0.0-4build1 (319 bytes)

6.1.0-1ubuntu0.2

Obsolete in eoan-updates on 2020-12-29

Obsolete in eoan-security on 2020-12-29

pillow (6.1.0-1ubuntu0.2) eoan-security; urgency=medium

  * SECURITY UPDATE: Exceed memory amount and delay in process image
    - debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
      PIL/PsdImagePlugin.py, Added decompression bomb checks in
      PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
      in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
      in Tests/images/*.
    - CVE-2019-16865
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-19911.patch:  Raise an error for an invalid
      number of bands in FPX image in PIL/FpxImagePlugin.py and added some
      testes in Test/images/*.
    - CVE-2019-19911
  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2020-5310.patch: Overflow checks for realloc for tiff
      decoding in src/libImaging/TiffDecode.c and added tests in Test/images/*.
    - CVE-2020-5310
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5311.patch: catch SGI buffer overruns
      in src/libImaging/SgiRleDecode.c.
    - CVE-2020-5311
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
      in libImaging/PcxDecode.c and added some tests in Test/images/*.
    - CVE-2020-5312
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
      libImaging/FliDecode.c and added some tests in Test/images/*.
    - CVE-2020-5313

 -- <email address hidden> (Leonidas S. Barbosa)  Mon, 03 Feb 2020 14:50:52 -0300

Available diffs

diff from 6.1.0-1ubuntu0.1 to 6.1.0-1ubuntu0.2 (560 bytes)

5.1.0-1ubuntu0.2

Superseded in bionic-updates on 2020-07-22

Superseded in bionic-security on 2020-07-22

pillow (5.1.0-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: Exceed memory amount and delay in process image
    - debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
      PIL/PsdImagePlugin.py, Added decompression bomb checks in
      PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
      in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
      in Tests/images/*.
    - CVE-2019-16865
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-19911.patch:  Raise an error for an invalid
      number of bands in FPX image in PIL/FpxImagePlugin.py and added some
      testes in Test/images/*.
    - CVE-2019-19911
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5311.patch: catch SGI buffer overruns
      in src/libImaging/SgiRleDecode.c.
    - CVE-2020-5311
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
      in libImaging/PcxDecode.c and added some tests in Test/images/*.
    - CVE-2020-5312
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
      libImaging/FliDecode.c and added some tests in Test/images/*.
    - CVE-2020-5313

 -- <email address hidden> (Leonidas S. Barbosa)  Mon, 03 Feb 2020 13:04:40 -0300

Available diffs

diff from 5.1.0-1ubuntu0.1 to 5.1.0-1ubuntu0.2 (473 bytes)

3.1.2-0ubuntu1.3

Superseded in xenial-updates on 2020-07-22

Superseded in xenial-security on 2020-07-22

pillow (3.1.2-0ubuntu1.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Exceed memory amount and delay in process image
    - debian/patches/CVE-2019-16865-*.patch: Corrected negative seeks in
      PIL/PsdImagePlugin.py, Added decompression bomb checks in
      PIL/GifImagePlugin.py and PIL/IcoImagePlugin.py, Catch buffer overruns
      in libImaging/PcxDecode.c, libImaging/FliDecode.c and added some tests
      in Tests/images/*.
    - CVE-2019-16865
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-19911.patch:  Raise an error for an invalid
      number of bands in FPX image in PIL/FpxImagePlugin.py.
    - CVE-2019-19911
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5312.patch: Catch PCX P mode buffer overrun
      in libImaging/PcxDecode.c.
    - CVE-2020-5312
  * SECURITY UPDATE: Buffer overflow
    - debian/patches/CVE-2020-5313.patch: catch FLI buffer overrun in
      libImaging/FliDecode.c.
    - CVE-2020-5313
  * Fix decompression tests that failed
    - debian/patches/Fixing_decompression_test.patch: Tests/test_decompression.py.

 -- <email address hidden> (Leonidas S. Barbosa)  Thu, 30 Jan 2020 17:15:56 -0300

Available diffs

diff from 3.1.2-0ubuntu1.1 (in ~ubuntu-security/ubuntu/ppa) to 3.1.2-0ubuntu1.3 (16.0 KiB)
diff from 3.1.2-0ubuntu1.2 to 3.1.2-0ubuntu1.3 (1.2 KiB)

7.0.0-4

Superseded in focal-release on 2020-02-21

Deleted in focal-proposed on 2020-02-22 (Reason: moved to Release)

pillow (7.0.0-4) unstable; urgency=medium

  * Don't rely on python2's python.mk in the build.
  * Bump standards version.

 -- Matthias Klose <email address hidden>  Wed, 29 Jan 2020 08:33:20 +0100

Available diffs

diff from 6.2.1-2 to 7.0.0-4 (173.2 KiB)
diff from 7.0.0-3 to 7.0.0-4 (685 bytes)

7.0.0-3

Superseded in focal-proposed on 2020-01-29

pillow (7.0.0-3) unstable; urgency=medium

  * Drop the Python2 autopkg tests.

 -- Matthias Klose <email address hidden>  Sun, 12 Jan 2020 09:54:31 +0100

Available diffs

diff from 7.0.0-2 to 7.0.0-3 (848 bytes)

7.0.0-2

Superseded in focal-proposed on 2020-01-12

pillow (7.0.0-2) unstable; urgency=medium

  * Build-depend on python2 for the use of python.mk.

 -- Matthias Klose <email address hidden>  Mon, 06 Jan 2020 16:19:39 +0100

Available diffs

diff from 6.2.1-2 to 7.0.0-2 (172.5 KiB)

6.2.1-2

Superseded in focal-release on 2020-01-29

Deleted in focal-proposed on 2020-02-09 (Reason: moved to Release)

pillow (6.2.1-2) unstable; urgency=medium

  * Call python2 in the autopkg python2 tests.

 -- Matthias Klose <email address hidden>  Mon, 04 Nov 2019 08:41:21 +0100

Available diffs

diff from 6.1.0-1build1 (in Ubuntu) to 6.2.1-2 (59.0 KiB)
diff from 6.2.1-1 to 6.2.1-2 (542 bytes)

6.2.1-1

Superseded in focal-proposed on 2019-11-04

pillow (6.2.1-1) unstable; urgency=medium

  * New upstream version, "last Pillow release to support Python 2.7".
  * Replaces python-dbg debpendencies with python2-dbg.
  * Remove Python2 suggests.

 -- Matthias Klose <email address hidden>  Sat, 26 Oct 2019 16:49:09 +0200

Available diffs

diff from 6.2.0-1 to 6.2.1-1 (3.3 KiB)

6.1.0-1build1

Superseded in focal-release on 2019-11-10

Deleted in focal-proposed on 2019-11-11 (Reason: moved to Release)

pillow (6.1.0-1build1) focal; urgency=medium

  * No-change rebuild to build with python3.8.

 -- Matthias Klose <email address hidden>  Fri, 18 Oct 2019 18:08:59 +0000

Available diffs

diff from 6.1.0-1 (in Debian) to 6.1.0-1build1 (306 bytes)

Ubuntupillow package

Change log for pillow package in Ubuntu

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Available diffs

Ubuntu
pillow package