CVE-2022-1253

Advisory

Pillow-heif 0.6.1 fixes HEIF decoder's CVEs.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This release contains security and bug fixes.

Added

Changed

- Speed boost for AVIF encoding(+50%). [commit](https://github.com/strukturag/libheif/commit/4ec2ac35e2cd79e8594092f6e36b5eace19cefdf)

Fixed

- (Linux, Windows) libde265: CVE-2022-1253, CVE-2021-36408, CVE-2021-36410, CVE-2021-35452, CVE-2021-36411 [MSYS2 PR](https://github.com/msys2/MINGW-packages/pull/12513)
- libheif: with chroma=`420`(which is a default mode) encoded images are closer to the originals with arrived patches. [libheif issue](https://github.com/strukturag/libheif/issues/521)
- libheif: scaling of images in some cases: [commit](https://github.com/strukturag/libheif/commit/0cd461e18b99d018f9adef731eec928781078afb)
- Total `21` patches with fixes from official libheif repo has arrived.

Resources

• https://pypi.org/project/pillow-heif
• https://pyup.io/changelogs/pillow-heif/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1253