Skip to content

Commit 66a21cc

Browse files
committed
Update release notes to match template for #7864
1 parent d48a6cf commit 66a21cc

File tree

4 files changed

+32
-32
lines changed

4 files changed

+32
-32
lines changed

docs/releasenotes/2.3.1.rst

+4-4
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,10 @@ These issues reported in
1111
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
1212

1313
The (1) load_djpeg function in ``JpegImagePlugin.py``, (2) Ghostscript function
14-
in EpsImagePlugin.py, (3) load function in ``IptcImagePlugin.py``, and (4) _copy
15-
function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and
16-
Pillow before 2.3.1 do not properly create temporary files, which allow local
17-
users to overwrite arbitrary files and obtain sensitive information via a
14+
in EpsImagePlugin.py, (3) load function in ``IptcImagePlugin.py``, and (4)
15+
``_copy`` function in Image.py in Python Image Library (PIL) 1.1.7 and earlier
16+
and Pillow before 2.3.1 do not properly create temporary files, which allow
17+
local users to overwrite arbitrary files and obtain sensitive information via a
1818
symlink attack on the temporary file.
1919

2020
:cve:`2014-1933`: Fix insecure use of :py:func:`tempfile.mktemp`

docs/releasenotes/4.2.0.rst

+23-23
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,29 @@
11
4.2.0
22
-----
33

4+
Deprecations
5+
============
6+
7+
Several deprecated items have been removed
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
9+
10+
* The methods ``PIL.ImageWin.Dib.fromstring``,
11+
``PIL.ImageWin.Dib.tostring`` and
12+
``PIL.TiffImagePlugin.ImageFileDirectory_v2.as_dict`` have
13+
been removed.
14+
15+
* Before Pillow 4.2.0, attempting to save an RGBA image as JPEG would
16+
discard the alpha channel. From Pillow 3.4.0, a deprecation warning
17+
was shown. From Pillow 4.2.0, the deprecation warning is removed and
18+
an :py:exc:`IOError` is raised.
19+
20+
Removed Core Image Function
21+
^^^^^^^^^^^^^^^^^^^^^^^^^^^
22+
23+
The unused function ``Image.core.new_array`` was removed. This is an
24+
internal function that should not have been used by user code, but it
25+
was accessible from the python layer.
26+
427
Other Changes
528
=============
629

@@ -30,26 +53,3 @@ New DecompressionBomb Warning
3053
:py:meth:`PIL.Image.Image.crop` now may raise a DecompressionBomb
3154
warning if the crop region enlarges the image over the threshold
3255
specified by :py:data:`PIL.Image.MAX_IMAGE_PIXELS`.
33-
34-
Deprections
35-
===========
36-
37-
Several deprecated items have been removed
38-
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
39-
40-
* The methods ``PIL.ImageWin.Dib.fromstring``,
41-
``PIL.ImageWin.Dib.tostring`` and
42-
``PIL.TiffImagePlugin.ImageFileDirectory_v2.as_dict`` have
43-
been removed.
44-
45-
* Before Pillow 4.2.0, attempting to save an RGBA image as JPEG would
46-
discard the alpha channel. From Pillow 3.4.0, a deprecation warning
47-
was shown. From Pillow 4.2.0, the deprecation warning is removed and
48-
an :py:exc:`IOError` is raised.
49-
50-
Removed Core Image Function
51-
^^^^^^^^^^^^^^^^^^^^^^^^^^^
52-
53-
The unused function ``Image.core.new_array`` was removed. This is an
54-
internal function that should not have been used by user code, but it
55-
was accessible from the python layer.

docs/releasenotes/6.2.2.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
Security
55
========
66

7-
This release fixes several buffer overruns and DOS attacks.
7+
This release fixes several buffer overflow issues and a DOS attack vulnerability.
88

99
:cve:`2019-19911`: DOS attack vulnerability
1010
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

docs/releasenotes/8.3.0.rst

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,11 @@
44
Security
55
========
66

7-
:cve:`2021-34552`: Buffer overflow
8-
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
7+
:cve:`2021-34552`: Fix buffer overflow
8+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
99

10-
PIL since 1.1.4 and Pillow since 1.0 allowed parameters passed into a convert function to trigger
11-
buffer overflow in Convert.c.
10+
PIL since 1.1.4 and Pillow since 1.0 allowed parameters passed into a convert
11+
function to trigger buffer overflow in ``Convert.c``.
1212

1313
Parsing XML
1414
^^^^^^^^^^^

0 commit comments

Comments
 (0)