pillow (2.3.0-1ubuntu3.4) trusty-security; urgency=medium

  * SECURITY UPDATE: information disclosure via crafted image
    - debian/patches/CVE-2016-9189.patch: add overflow checks to map.c.
    - CVE-2016-9189
  * SECURITY UPDATE: code execution via crafted image
    - debian/patches/CVE-2016-9190.patch: add size check to
      libImaging/Storage.c, add test to Tests/images/negative_size.ppm,
      Tests/test_file_ppm.py.
    - CVE-2016-9190
  * SECURITY UPDATE: re-enabled CVE-2014-9601 fix
    - debian/patches/pillow-CVE-2014-9601-pre.patch: rename len variables
      as length in PIL/PngImagePlugin.py.
    - debian/patches/pillow-CVE-2014-9601.patch: updated.
    - debian/patches/revert-CVE-201409601.patch: removed
    - CVE-2014-9601

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 10 Mar 2017 08:26:41 -0500

pillow (2.3.0-1ubuntu3.3) trusty-security; urgency=medium

  * SECURITY UPDATE: revert fix for CVE-2014-9601 which caused regression
    - debian/patches/revert-CVE-201409601.patch 

 -- Emily Ratliff <emily.ratliff@canonical.com>  Thu, 29 Sep 2016 20:48:05 -0500

pillow (2.3.0-1ubuntu3.2) trusty-security; urgency=medium

  * SECURITY UPDATE: buffer overflow in ImagingFliDecode()
    - debian/patches/pillow-CVE-2016-0775.patch: correct memcpy location
    - Thanks to Eric Soroos for finding and fixing this issue.
    - CVE-2016-0775
  * SECURITY UPDATE: buffer overflow in ImagingLibTiffDecode
    - debian/patches/pillow-CVE-2016-0740.patch: correct type of size to
      match that returned by libtiff
    - Thanks to Eric Soroos for finding and fixing this issue.
    - CVE-2016-0740
  * SECURITY UPDATE: PCD decoder overruns the shuffle buffer
    - debian/patches/pillow-CVE-2016-2533.patch: correct size adjustments
    - CVE-2016-2533
  * SECURITY-UPDATE: Icns DOS fix
    - debian/patches/pillow-CVE-2014-3589.patch: Icns DOS fix
    - Thanks to Andrew Drake for reporting this issue.
    - CVE-2014-3589
  * SECURITY-UPDATE: Fix potential PNG decompression DOS
    - debian/patches/pillow-CVE-2014-9601.patch: Fix PNG decompresson DOS
    - CVE-2014-9601

 -- Emily Ratliff <emily.ratliff@canonical.com>  Mon, 26 Sep 2016 18:03:27 -0500

pillow (2.3.0-1ubuntu3) trusty; urgency=medium

  * SECURITY UPDATE: insecure use of temporary files
    - debian/patches/CVE-2014-193x.patch: use tempfile.mkstemp() in
      PIL/EpsImagePlugin.py, PIL/Image.py, PIL/IptcImagePlugin.py,
      PIL/JpegImagePlugin.py.
    - CVE-2014-1932
    - CVE-2014-1933

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 31 Mar 2014 10:07:00 -0400

pillow (2.3.0-1ubuntu2) trusty; urgency=medium

  * No-change rebuild to drop Python 3.3 support.

 -- Matthias Klose <doko@ubuntu.com>  Sun, 23 Mar 2014 15:28:42 +0000

pillow (2.3.0-1ubuntu1) trusty; urgency=medium

  * Merge with Debian; remaining changes:
    - Provide transitional packages.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 04 Feb 2014 14:51:27 +0100

pillow (2.3.0-1) unstable; urgency=medium

  * New upstream version.
  * Don't ship the color profiles in the source and disable the tests
    using the profiles. Closes: #737425.
  * Support a webp file in $ADTTMP in the testsuite, and generate it in the
    autopktests. Closes: #736242.

 -- Matthias Klose <doko@debian.org>  Tue, 04 Feb 2014 15:02:06 +0100

pillow (2.2.1-3ubuntu6) trusty; urgency=medium

  * Support a webp file in $ADTTMP in the testsuite, and generate it in the
    autopktests.

 -- Iain Lane <iain.lane@canonical.com>  Tue, 21 Jan 2014 12:11:02 +0000

pillow (2.2.1-3ubuntu5) trusty; urgency=medium

  * No-change rebuild for libwebp transition

 -- Iain Lane <iain.lane@canonical.com>  Mon, 20 Jan 2014 12:18:23 +0000

pillow (2.2.1-3ubuntu4) trusty; urgency=medium

  * No-change rebuild for Tcl/Tk 8.6.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 03 Jan 2014 01:55:28 +0100

# For older changelog entries, run 'apt-get changelog python-imaging-sane'
