Pillow: Question regarding CVE-2019-16865

[rfrohl]

Hi,
I am looking at CVE-2019-16865 [0] reported as fixed with the new 6.2 release, but the information about it is quite limited and I could not find a specific mention in git log. In addition the Changelog does not seem to mention anything specifically security related.

Would it be possible to elaborate a bit about the issue and maybe point to a commit fixing the issue ?

Thanks in advance!

[0] https://nvd.nist.gov/vuln/detail/CVE-2019-16865

[hugovk]

Hi, it's the changes from these PRs:

• https://github.com/python-pillow/Pillow/pull/4101 "Corrected negative seeks"
• https://github.com/python-pillow/Pillow/pull/4102 "Added decompression bomb checks"
• https://github.com/python-pillow/Pillow/pull/4103 "Catch buffer overruns"
• https://github.com/python-pillow/Pillow/pull/4104 "Raise error if TIFF dimension is a string"

[rfrohl]

@hugovk Thanks for the quick answer!