Skip to content

Commit

Permalink
Combine CVEs
Browse files Browse the repository at this point in the history
  • Loading branch information
aclark4life committed Mar 15, 2024
1 parent 15deb71 commit ad134c6
Showing 1 changed file with 6 additions and 18 deletions.
24 changes: 6 additions & 18 deletions docs/releasenotes/8.1.2.rst
Expand Up @@ -4,24 +4,12 @@
Security
========

:cve:`2021-27921`: There is an exhaustion of memory DOS in BLP images
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
:cve:`2021-27921`, :cve:`2021-27922`, :cve:`2021-27923`: Fix DOS attacks
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

There is an exhaustion of memory DOS in BLP images. where Pillow did not properly check the
reported size of the contained image. These images could cause arbitrarily large memory
allocations.
There is an exhaustion of memory DOS attack in BLP, ICNS, ICO images
where Pillow did not properly check the reported size of the contained image.
These images could cause arbitrarily large memory allocations.

:cve:`2021-27922`: There is an exhaustion of memory DOS in ICNS images
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

There is an exhaustion of memory DOS in ICNS images where Pillow did not properly check the
reported size of the contained image. These images could cause arbitrarily large memory allocations.

:cve:`2021-27923`: There is an exhaustion of memory DOS in ICO images
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

There is an exhaustion of memory DOS in ICO images where Pillow did not properly check the reported
size of the contained image. These images could cause arbitrarily large memory allocations.

These were reported by Jiayi Lin, Luke Shaffer, Xinran Xie and
These issues were reported by Jiayi Lin, Luke Shaffer, Xinran Xie and
Akshay Ajayan of `Arizona State University <https://www.asu.edu/>`_.

0 comments on commit ad134c6

Please sign in to comment.