Описание
Security update for python-Pillow
This update for python-Pillow fixes the following issues
- CVE-2026-42308: integer overflow in font processing can lead to denial of service (bsc#1265359).
- CVE-2026-42309: heap buffer overflow when processing nested list coordinates (bsc#1265153).
- CVE-2026-42310: infinite loop and resource exhaustion when processing specially crafted PDFs (bsc#1265154).
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1265153
- SUSE Bug 1265154
- SUSE Bug 1265359
- SUSE CVE CVE-2026-42308 page
- SUSE CVE CVE-2026-42309 page
- SUSE CVE CVE-2026-42310 page
Описание
Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.
Затронутые продукты
Ссылки
- CVE-2026-42308
- SUSE Bug 1265359
Описание
Pillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.
Затронутые продукты
Ссылки
- CVE-2026-42309
- SUSE Bug 1265153
Описание
Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.
Затронутые продукты
Ссылки
- CVE-2026-42310
- SUSE Bug 1265154