Support for FreeType 2.7 is deprecated and will be removed in Pillow 9.0.0 (2022-01-02), when FreeType 2.8 will be the minimum supported.
install-venv target has been deprecated.
Append images to ICO¶
When saving an ICO image, the file may contain versions of the image at different sizes. By default, Pillow will scale down the main image to create these copies.
With this release, a list of images can be provided to the
when saving, to replace the scaled down versions. This is the same functionality that
already exists for the ICNS format.
This release includes security fixes.
An out-of-bounds read when saving TIFFs with custom metadata through LibTIFF
An out-of-bounds read when saving a GIF of 1px width
CVE-2020-35653 Buffer read overrun in PCX decoding
The PCX image decoder used the reported image stride to calculate the row buffer, rather than calculating it from the image size. This issue dates back to the PIL fork. Thanks to Google’s OSS-Fuzz project for finding this.
CVE-2020-35654 Fix TIFF out-of-bounds write error
Out-of-bounds write in
TiffDecode.c when reading corrupt YCbCr files in some
LibTIFF versions (4.1.0/Ubuntu 20.04, but not 4.0.9/Ubuntu 18.04). In some cases
LibTIFF’s interpretation of the file is different when reading in RGBA mode, leading to
an out-of-bounds write in
TiffDecode.c. This potentially affects Pillow versions
from 6.0.0 to 8.0.1, depending on the version of LibTIFF. This was reported through
CVE-2020-35655 Fix for SGI Decode buffer overrun
4 byte read overflow in
SgiRleDecode.c, where the code was not correctly checking the
offsets and length tables. Independently reported through Tidelift and Google’s
OSS-Fuzz. This vulnerability covers Pillow versions 4.3.0->8.0.1.
OpenJPEG in the macOS and Linux wheels has been updated from 2.3.1 to 2.4.0, including security fixes.
LibTIFF in the macOS and Linux wheels has been updated from 4.1.0 to 4.2.0, including security fixes discovered by fuzzers.