|
pillow (9.0.1-1ubuntu0.6) jammy-security; urgency=medium
* SECURITY UPDATE: crash or info disclosure via incorrect map stride
- debian/patches/CVE-2026-54058.patch: Ensure map stride is at least one
full row of pixels (#9719) in src/map.c.
- CVE-2026-54058
* SECURITY UPDATE: excessive memory allocation via FontFile
- debian/patches/CVE-2026-54059_54060_55379.patch: Add decompression bomb
checks to FontFile classes (#9711) in Tests/test_font_bdf.py,
Tests/test_font_pcf.py, src/PIL/BdfFontFile.py, src/PIL/FontFile.py,
src/PIL/PcfFontFile.py.
- CVE-2026-54059
- CVE-2026-54060
- CVE-2026-55379
* SECURITY UPDATE: excessive memory allocation via GdImageFile
- debian/patches/CVE-2026-55380.patch: Add decompression bomb check to
GdImageFile (#9693) in Tests/test_file_gd.py, src/PIL/GdImageFile.py.
- CVE-2026-55380
* SECURITY UPDATE: heap out-of-bounds read via rank filter API
- debian/patches/CVE-2026-59197-pre1.patch: Validate size and rank when
initializing RankFilter (#9661) in Tests/test_image_filter.py,
src/PIL/ImageFilter.py.
- debian/patches/CVE-2026-59197-pre2.patch: Removed unused argument in
src/PIL/Image.py, src/_imaging.c, src/libImaging/Filter.c,
src/libImaging/Imaging.h.
- debian/patches/CVE-2026-59197-pre3.patch: Only pass one argument to C
expand (#9664) in src/PIL/ImageFilter.py, src/_imaging.c,
src/libImaging/Filter.c, src/libImaging/Imaging.h.
- debian/patches/CVE-2026-59197-pre4.patch: Removed _expand() in
Tests/test_image.py, src/PIL/Image.py.
- debian/patches/CVE-2026-59197-1.patch: Validate large filter sizes when
initializing RankFilter in Tests/test_image_filter.py,
src/PIL/ImageFilter.py.
- debian/patches/CVE-2026-59197-2.patch: Validate margin in ImagingExpand in
Tests/test_image_filter.py, src/libImaging/Filter.c.
- CVE-2026-59197
* SECURITY UPDATE: heap out-of-bounds read via image coordinate API
- debian/patches/CVE-2026-59199.patch: Use int64_t to calculate paste box
dimensions (#9703) in Tests/test_image_paste.py, src/libImaging/Paste.c.
- CVE-2026-59199
* SECURITY UPDATE: memory exaustion issue via PDF stram
- debian/patches/CVE-2026-59200.patch: Add max_length to PdfStream decode()
(#9718) in Tests/test_pdfparser.py, src/PIL/PdfParser.py.
- CVE-2026-59200
* SECURITY UPDATE: memory consumption issue via JPEG2000 files
- debian/patches/CVE-2026-59204.patch: Calculate JPEG2000
total_component_width for each tile in isolation (#9704) in
src/libImaging/Jpeg2KDecode.c.
- CVE-2026-59204
* SECURITY UPDATE: heap corruption issue via incorrect output image
- debian/patches/CVE-2026-59205-1.patch: Simplify code by calling apply()
from apply_in_place() in src/PIL/ImageCms.py.
- debian/patches/CVE-2026-59205-2.patch: Raise error if output image mode
does not match transform output mode in Tests/test_imagecms.py,
src/PIL/ImageCms.py.
- debian/patches/CVE-2026-59205-3.patch: Raise error if input image mode
does not match transform input mode in Tests/test_imagecms.py,
src/PIL/ImageCms.py.
- CVE-2026-59205
-- Marc Deslauriers Tue, 22 Sep 2026 09:13:51 -0400
|
| CVE-2026-54058 |
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec p |
| CVE-2026-54059 |
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed |
| CVE-2026-54060 |
Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image. |
| CVE-2026-55379 |
Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passe |
| CVE-2026-55380 |
Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored t |
| CVE-2026-59197 |
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very |
| CVE-2026-59199 |
Pillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coo |
| CVE-2026-59200 |
Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize se |
| CVE-2026-59204 |
Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a |
| CVE-2026-59205 |
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corr |
|
