Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:2875-1

Опубликовано: 13 июл. 2026
Источник: suse-cvrf

Описание

Security update for python-Pillow

This update for python-Pillow fixes the following issues

  • CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).
  • CVE-2026-54060: a font can trigger excessive allocation during conversion or saving (bsc#1270410).
  • CVE-2026-55379: bypass of decompression bomb protection, allowing excessive memory allocation (bsc#1270411).
  • CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).

Список пакетов

SUSE Linux Enterprise Module for Package Hub 15 SP7
python3-Pillow-7.2.0-150300.3.27.1

Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.27.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.27.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.27.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

Затронутые продукты
SUSE Linux Enterprise Module for Package Hub 15 SP7:python3-Pillow-7.2.0-150300.3.27.1
Ссылки
Уязвимость SUSE-SU-2026:2875-1