CVE 2020-10177: Multiple out-of-bounds reads in FLI decoding¶

Pillow before 7.1.0 has multiple out-of-bounds reads inlibImaging/FliDecode.c.

CVE 2020-10378: Bounds overflow in PCX decoding¶

InlibImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occurwhen reading PCX files wherestate->shuffle is instructed to read beyondstate->buffer.

CVE 2020-10379: Two buffer overflows in TIFF decoding¶

In Pillow before 7.1.0, there are two buffer overflows inlibImaging/TiffDecode.c.

CVE 2020-10994: Bounds overflow in JPEG 2000 decoding¶

InlibImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multipleout-of-bounds reads via a crafted JP2 file.

CVE 2020-11538: Buffer overflow in SGI-RLE decoding¶

InlibImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-boundsreads exist in the parsing of SGI image files, a different issue thanCVE 2020-5311.

Allow saving of zero quality JPEG images¶

If no quality was specified when saving a JPEG, Pillow internally used a valueof zero to indicate that the default quality should be used. However, thisremoved the ability to actually save a JPEG with zero quality. This has nowbeen resolved.

fromPILimportImageim=Image.open("hopper.jpg")im.save("out.jpg",quality=0)

New channel operations¶

Three new channel operations have been added:soft_light(),hard_light() andoverlay().

PILLOW_VERSION constant¶

PILLOW_VERSION has been re-added but is deprecated and will be removed in a futurerelease. Use__version__ instead.

It was initially removed in Pillow 7.0.0, but brought back in 7.1.0 to give projectsmore time to upgrade.

Reading JPEG comments¶

When opening a JPEG image, the comment may now be read intoinfo.

Support for different charset encodings in PcfFontFile¶

PreviouslyPcfFontFile output only bitmap PIL fonts with ISO 8859-1 encoding, eventhough the PCF format supports Unicode, making it hard to work with Pillow with bitmapfonts in languages which use different character sets.

Now it’s possible to set a different charset encoding inPcfFontFile’s classconstructor. By default, it generates a PIL font file with ISO 8859-1 as before. Thegenerated PIL font file still contains up to 256 characters, but the character set isdifferent depending on the selected encoding.

To use such a font withImageDraw.text, call it with a bytes object with the sameencoding as the font file.

X11 ImageGrab.grab()¶

Support has been added forImageGrab.grab() on Linux using the X serverwith the XCB library.

An optionalxdisplay parameter has been added to select the X server,with the default value ofNone using the default X server.

Passing a different value on Windows or macOS will force taking a snapshotusing the selected X server; pass an empty string to use the default X server.XCB support is not included in pre-compiled wheels for Windows and macOS.

If present, only use alpha channel for bounding box¶

When thegetbbox() method calculates the boundingbox, for an RGB image it trims black pixels. Similarly, for an RGBA image itwould trim black transparent pixels. This is now changed so that if an imagehas an alpha channel (RGBA, RGBa, PA, LA, La), any transparent pixels aretrimmed.

Improved APNG support¶

Added support for reading and writing Animated Portable Network Graphics (APNG) images.The PNG plugin now supports using theseek() method and theIterator class to read APNG frame sequences.The PNG plugin also now supports using theappend_images argument to write APNG framesequences. SeeAPNG sequences for further details.