Add CVE-2023-44271 to release notes

[hugovk]

Document that the security fix in 10.0.0 that added ImageFont.MAX_STRING_LENGTH was assigned CVE-2023-44271.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44271

https://devhub.checkmarx.com/cve-details/CVE-2023-44271/

[jkylekelly]

Does this CVE only affect references via ImageDraw & ImageDraw2? For example:

    d = ImageDraw.Draw(image)
    d.text(_get_offset(image, font, text), text, font=font, fill="black")

Or would direct calls to the patched ImageFont functions also be vulnerable? I.e., text_bbox = font.getbbox(text) where font is of the class ImageFont.FreeTypeFont?

Thanks!

[radarhere]

Yes, ImageFont is also relevant. You can see in #7244 that the code for getbbox() was also modified when implementing this.