Upgrading pillow 6 to 7
Safe6.2.2 → 7.2.0Security5
SecurityIn Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.GHSA-8843-m7mw-mxqm · CVE-2020-10379 ↗
SafeUpgrade verdict
5 security fixes. Nothing to change in your code.
In plain terms
- In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
- In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
- In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
- Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
Must act Top 3 of 5 that need code or config changes
Python requirement changed in 7.0.0: >=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, !=3.4.* → >=3.5.
What you must change
Security5
In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.
In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.
In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.
Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.
In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- added:
class UnidentifiedImageError(OSError)
- changed:
class ContainerIO(object) → class ContainerIO
- removed:
property DcxImageFile.is_animated - removed:
property DcxImageFile.n_frames
- removed:
variable which - changed:
class PSFile(object) → class PSFile
- removed:
property FliImageFile.is_animated - removed:
property FliImageFile.n_frames
- changed:
class FontFile(object) → class FontFile
- changed:
class GradientFile(object) → class GradientFile
- changed:
class GimpPaletteFile(object) → class GimpPaletteFile
- removed:
variable im - removed:
variable imf - changed:
class IcnsFile(object) → class IcnsFile
- changed:
class IcoFile(object) → class IcoFile
- removed:
method Exif.has_key(tag) - removed:
variable HAS_PATHLIB - removed:
variable builtins - changed:
class Image(object) → class Image - changed:
class ImagePointHandler(object) → class ImagePointHandler - changed:
class ImageTransformHandler(object) → class ImageTransformHandler - changed:
method Image.resize(size, resample=…, box=…) → method Image.resize(size, resample=…, box=…, reducing_gap=…) - changed:
method Image.thumbnail(size, resample=…) → method Image.thumbnail(size, resample=…, reducing_gap=…) - added:
method Image.reduce(factor, box=…)
- added:
function hard_light(image1, image2) - added:
function overlay(image1, image2) - added:
function soft_light(image1, image2)
- changed:
class ImageCmsProfile(object) → class ImageCmsProfile
- changed:
class ImageDraw(object) → class ImageDraw
- changed:
class Brush(object) → class Brush - changed:
class Draw(object) → class Draw - changed:
class Font(object) → class Font - changed:
class Pen(object) → class Pen
- removed:
method ImageFile.draft(mode, size) - changed:
class Parser(object) → class Parser - changed:
class PyCodecState(object) → class PyCodecState - changed:
class PyDecoder(object) → class PyDecoder - added:
function raise_oserror(error)
- changed:
class Filter(object) → class Filter
- changed:
class FreeTypeFont(object) → class FreeTypeFont - changed:
class ImageFont(object) → class ImageFont - changed:
class TransposedFont(object) → class TransposedFont
- removed:
variable grabber - changed:
function grab(bbox=…, include_layered_windows=…, all_screens=…) → function grab(bbox=…, include_layered_windows=…, all_screens=…, xdisplay=…)
- removed:
variable builtins
- changed:
class ModeDescriptor(object) → class ModeDescriptor
- changed:
class LutBuilder(object) → class LutBuilder - changed:
class MorphOp(object) → class MorphOp
- changed:
class ImagePalette(object) → class ImagePalette
- removed:
variable WARNING_TEXT
- removed:
method Iterator.next() - changed:
class Iterator(object) → class Iterator
- removed:
function which(executable) - changed:
class Viewer(object) → class Viewer
- changed:
class Stat(object) → class Stat
- changed:
class BitmapImage(object) → class BitmapImage - changed:
class PhotoImage(object) → class PhotoImage
- changed:
class Dib(object) → class Dib - changed:
class HDC(object) → class HDC - changed:
class HWND(object) → class HWND - changed:
class Window(object) → class Window
- added:
property Jpeg2KImageFile.reduce
- removed:
property MicImageFile.is_animated - removed:
property MicImageFile.n_frames
- changed:
class BitStream(object) → class BitStream
- removed:
property MpoImageFile.is_animated - removed:
property MpoImageFile.n_frames
- changed:
class PSDraw(object) → class PSDraw
- changed:
class PaletteFile(object) → class PaletteFile
- changed:
constructor PcfFontFile(fp) → constructor PcfFontFile(fp, charset_encoding=…)
- removed:
function make_bytes(s) - removed:
variable UserDict - changed:
class PdfDict(UserDict) → class PdfDict(collections.UserDict)
- changed:
class ChunkStream(object) → class ChunkStream - changed:
class PngInfo(object) → class PngInfo - added:
method PngImageFile.seek(frame) - added:
method PngImageFile.tell() - added:
method PngStream.chunk_fcTL(pos, length) - added:
method PngStream.chunk_fdAT(pos, length) - added:
method PngStream.rewind() - added:
method PngStream.save_rewind() - added:
variable APNG_BLEND_OP_OVER - added:
variable APNG_BLEND_OP_SOURCE - added:
variable APNG_DISPOSE_OP_BACKGROUND - added:
variable APNG_DISPOSE_OP_NONE - added:
variable APNG_DISPOSE_OP_PREVIOUS
- removed:
property PsdImageFile.is_animated - removed:
property PsdImageFile.n_frames
- changed:
class PyAccess(object) → class PyAccess - added:
variable FFI
- removed:
variable im - removed:
variable outfile
- removed:
method ImageFileDirectory_v2.has_key(tag) - removed:
property TiffImageFile.is_animated - removed:
property TiffImageFile.size - removed:
variable DEBUG - added:
variable logger
- removed:
variable builtins
- removed:
property WebPImageFile.is_animated - removed:
property WebPImageFile.n_frames
- removed:
variable long - changed:
class WmfHandler(object) → class WmfHandler - added:
method WmfStubImageFile.load(dpi=…)
- changed:
function pilinfo(out=…) → function pilinfo(out=…, supported_formats=…) - added:
function version(feature) - added:
function version_codec(feature) - added:
function version_feature(feature) - added:
function version_module(feature)