Описание
Important: python-pillow security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
-
python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379)
-
python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380)
-
python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059)
-
python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Затронутые продукты
Rocky Linux 8
Ссылки на источники
Исправления
- Red Hat - 2497452
- Red Hat - 2497455
- Red Hat - 2497464
- Red Hat - 2497466
Связанные уязвимости
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.
Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.