Merge lp:~noskcaj/ubuntu/trusty/pillow/2.3.1 into lp:ubuntu/trusty/pillow

[Jackson Doak]

New upstream bugfix release (CVE fix, nothing else)

[Sebastien Bacher (seb128)]

Thanks, could you give an url to download the upstream tarball? The source has no watch file nor upstream url in the control

review: Needs Information

[Jackson Doak (noskcaj)]

https://pypi.python.org/pypi/Pillow/2.3.1

On Mon, Mar 31, 2014 at 10:22 PM, Sebastien Bacher <email address hidden>wrote:

> Review: Needs Information
>
> Thanks, could you give an url to download the upstream tarball? The source
> has no watch file nor upstream url in the control
> --
>
> https://code.launchpad.net/~noskcaj/ubuntu/trusty/pillow/2.3.1/+merge/212247
> You are the owner of lp:~noskcaj/ubuntu/trusty/pillow/2.3.1.
>

Unmerged revisions

13. By Jackson Doak on 2014-03-21

* New upstream release.
  - Fix insecure use of tempfile.mktemp (CVE-2014-1932 CVE-2014-1933)

12. By Jackson Doak on 2014-03-21

* Merge with Debian; remaining changes:
  - Provide transitional packages.
* Build for python 3.4.

=== modified file '.pc/no-lib64-hack.diff/setup.py'
--- .pc/no-lib64-hack.diff/setup.py	2014-02-04 15:02:06 +0000
+++ .pc/no-lib64-hack.diff/setup.py	2014-03-21 21:22:46 +0000
@@ -85,7 +85,7 @@
 
 
 NAME = 'Pillow'
-VERSION = '2.3.0'
+VERSION = '2.3.1'
 TCL_ROOT = None
 JPEG_ROOT = None
 ZLIB_ROOT = None

=== modified file '.pc/toplevel-setup.py/setup.py'
--- .pc/toplevel-setup.py/setup.py	2014-02-04 15:02:06 +0000
+++ .pc/toplevel-setup.py/setup.py	2014-03-21 21:22:46 +0000
@@ -85,7 +85,7 @@
 
 
 NAME = 'Pillow'
-VERSION = '2.3.0'
+VERSION = '2.3.1'
 TCL_ROOT = None
 JPEG_ROOT = None
 ZLIB_ROOT = None

=== modified file '.travis.yml'
--- .travis.yml	2014-02-04 15:02:06 +0000
+++ .travis.yml	2014-03-21 21:22:46 +0000
@@ -10,7 +10,7 @@
   - 3.2
   - 3.3
 
-install: "sudo apt-get -qq install libfreetype6-dev liblcms2-dev libwebp-dev python-qt4 ghostscript""
+install: "sudo apt-get -qq install libfreetype6-dev liblcms2-dev libwebp-dev python-qt4 ghostscript"
 
 script:
   - python setup.py clean

=== modified file 'CHANGES.rst'
--- CHANGES.rst	2014-02-04 15:02:06 +0000
+++ CHANGES.rst	2014-03-21 21:22:46 +0000
@@ -1,6 +1,11 @@
 Changelog (Pillow)
 ==================
 
+2.3.1 (2014-03-14)
+------------------
+- Fix insecure use of tempfile.mktemp (CVE-2014-1932 CVE-2014-1933)
+  [wiredfool]
+
 2.3.0 (2014-01-01)
 ------------------
 

=== modified file 'PIL/EpsImagePlugin.py'
--- PIL/EpsImagePlugin.py	2014-02-04 15:02:06 +0000
+++ PIL/EpsImagePlugin.py	2014-03-21 21:22:46 +0000
@@ -67,7 +67,8 @@
 
     import tempfile, os, subprocess
 
-    file = tempfile.mktemp()
+    out_fd, file = tempfile.mkstemp()
+    os.close(out_fd)
 
     # Build ghostscript command
     command = ["gs",

=== modified file 'PIL/Image.py'
--- PIL/Image.py	2014-02-04 15:02:06 +0000
+++ PIL/Image.py	2014-03-21 21:22:46 +0000
@@ -495,14 +495,17 @@
         self.readonly = 0
 
     def _dump(self, file=None, format=None):
-        import tempfile
+        import tempfile, os
         if not file:
-            file = tempfile.mktemp()
+            f, file = tempfile.mkstemp(format or '')
+            os.close(f)
+            
         self.load()
         if not format or format == "PPM":
             self.im.save_ppm(file)
         else:
-            file = file + "." + format
+            if file.endswith(format):
+                file = file + "." + format
             self.save(file, format)
         return file
 

=== modified file 'PIL/IptcImagePlugin.py'
--- PIL/IptcImagePlugin.py	2014-02-04 15:02:06 +0000
+++ PIL/IptcImagePlugin.py	2014-03-21 21:22:46 +0000
@@ -172,8 +172,8 @@
         self.fp.seek(offset)
 
         # Copy image data to temporary file
-        outfile = tempfile.mktemp()
-        o = open(outfile, "wb")
+        o_fd, outfile = tempfile.mkstemp(text=False)
+        o = os.fdopen(o_fd)
         if encoding == "raw":
             # To simplify access to the extracted file,
             # prepend a PPM header

=== modified file 'PIL/JpegImagePlugin.py'
--- PIL/JpegImagePlugin.py	2013-11-11 23:48:20 +0000
+++ PIL/JpegImagePlugin.py	2014-03-21 21:22:46 +0000
@@ -344,13 +344,17 @@
         # ALTERNATIVE: handle JPEGs via the IJG command line utilities
 
         import tempfile, os
-        file = tempfile.mktemp()
-        os.system("djpeg %s >%s" % (self.filename, file))
+        f, path = tempfile.mkstemp()
+        os.close(f)
+        if os.path.exists(self.filename):
+            os.system("djpeg '%s' >'%s'" % (self.filename, path))
+        else:
+            raise ValueError("Invalid Filename")
 
         try:
-            self.im = Image.core.open_ppm(file)
+            self.im = Image.core.open_ppm(path)
         finally:
-            try: os.unlink(file)
+            try: os.unlink(path)
             except: pass
 
         self.mode = self.im.mode

=== modified file 'PIL/__init__.py'
--- PIL/__init__.py	2014-02-04 15:02:06 +0000
+++ PIL/__init__.py	2014-03-21 21:22:46 +0000
@@ -12,7 +12,7 @@
 # ;-)
 
 VERSION = '1.1.7'  # PIL version
-PILLOW_VERSION = '2.3.0' # Pillow
+PILLOW_VERSION = '2.3.1' # Pillow
 
 _plugins = ['ArgImagePlugin',
             'BmpImagePlugin',

=== modified file 'PKG-INFO'
--- PKG-INFO	2014-02-04 15:02:06 +0000
+++ PKG-INFO	2014-03-21 21:22:46 +0000
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: Pillow
-Version: 2.3.0
+Version: 2.3.1
 Summary: Python Imaging Library (Fork)
 Home-page: http://python-imaging.github.io/
 Author: Alex Clark (fork author)
@@ -29,6 +29,11 @@
         Changelog (Pillow)
         ==================
         
+        2.3.1 (2014-03-14)
+        ------------------
+        - Fix insecure use of tempfile.mktemp (CVE-2014-1932 CVE-2014-1933)
+          [wiredfool]
+        
         2.3.0 (2014-01-01)
         ------------------
         

=== modified file 'Pillow.egg-info/PKG-INFO'
--- Pillow.egg-info/PKG-INFO	2014-02-04 15:02:06 +0000
+++ Pillow.egg-info/PKG-INFO	2014-03-21 21:22:46 +0000
@@ -1,6 +1,6 @@
 Metadata-Version: 1.1
 Name: Pillow
-Version: 2.3.0
+Version: 2.3.1
 Summary: Python Imaging Library (Fork)
 Home-page: http://python-imaging.github.io/
 Author: Alex Clark (fork author)
@@ -29,6 +29,11 @@
         Changelog (Pillow)
         ==================
         
+        2.3.1 (2014-03-14)
+        ------------------
+        - Fix insecure use of tempfile.mktemp (CVE-2014-1932 CVE-2014-1933)
+          [wiredfool]
+        
         2.3.0 (2014-01-01)
         ------------------
         

=== added directory 'Tests/icc'
=== added file 'Tests/icc/CMY.icm'
Binary files Tests/icc/CMY.icm	1970-01-01 00:00:00 +0000 and Tests/icc/CMY.icm	2014-03-21 21:22:46 +0000 differ
=== added file 'Tests/icc/YCC709.icm'
Binary files Tests/icc/YCC709.icm	1970-01-01 00:00:00 +0000 and Tests/icc/YCC709.icm	2014-03-21 21:22:46 +0000 differ
=== added file 'Tests/icc/sRGB.icm'
Binary files Tests/icc/sRGB.icm	1970-01-01 00:00:00 +0000 and Tests/icc/sRGB.icm	2014-03-21 21:22:46 +0000 differ
=== modified file '_imaging.c'
--- _imaging.c	2014-02-04 15:02:06 +0000
+++ _imaging.c	2014-03-21 21:22:46 +0000
@@ -71,7 +71,7 @@
  * See the README file for information on usage and redistribution.
  */
 
-#define PILLOW_VERSION "2.3.0"
+#define PILLOW_VERSION "2.3.1"
 
 #include "Python.h"
 

=== modified file 'debian/changelog'
--- debian/changelog	2014-02-04 14:51:27 +0000
+++ debian/changelog	2014-03-21 21:22:46 +0000
@@ -1,3 +1,18 @@
+pillow (2.3.1-0ubuntu1) trusty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - Provide transitional packages.
+  * New upstream release.
+    - Fix insecure use of tempfile.mktemp (CVE-2014-1932 CVE-2014-1933)
+
+ -- Jackson Doak <[e-mail]>  Sat, 22 Mar 2014 07:55:09 +1100
+
+pillow (2.3.0-2) unstable; urgency=medium
+
+  * Build for python 3.4.
+
+ -- Matthias Klose <[e-mail]>  Wed, 12 Feb 2014 20:41:50 +0100
+
 pillow (2.3.0-1ubuntu1) trusty; urgency=medium
 
   * Merge with Debian; remaining changes:

=== modified file 'debian/control'
--- debian/control	2014-02-04 14:51:27 +0000
+++ debian/control	2014-03-21 21:22:46 +0000
@@ -5,7 +5,7 @@
 XSBC-Original-Maintainer: Matthias Klose <[e-mail]>
 Build-Depends: debhelper, tk-dev, dpkg-dev (>= 1.16.1~),
   python-all-dev (>= 2.7.3-11~), python-all-dbg, python-setuptools,
-  python3-all-dev (>= 3.3), python3-all-dbg, python3-setuptools,
+  python3-all-dev (>= 3.3.4), python3-all-dbg, python3-setuptools,
   python-tk, python-tk-dbg, python3-tk, python3-tk-dbg (>= 3.3),
   libsane-dev, libfreetype6-dev, libjpeg8-dev, zlib1g-dev, liblcms2-dev,
   libwebp-dev

=== modified file 'setup.py'
--- setup.py	2014-02-04 15:02:06 +0000
+++ setup.py	2014-03-21 21:22:46 +0000
@@ -92,7 +92,7 @@
 
 
 NAME = 'Pillow'
-VERSION = '2.3.0'
+VERSION = '2.3.1'
 TCL_ROOT = None
 JPEG_ROOT = None
 ZLIB_ROOT = None