Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21296-1

Опубликовано: 10 июл. 2026
Источник: suse-cvrf

Описание

Security update for python-Pillow

This update for python-Pillow fixes the following issues

  • CVE-2026-42311: malicious PSD file processing can lead to arbitrary code execution (bsc#1270404).
  • CVE-2026-54059: crafted PCF font data can cause excessive memory allocation (bsc#1270409).
  • CVE-2026-54060: fonts can trigger excessive memory allocation during conversion or saving (bsc#1270410).
  • CVE-2026-55379: bypass of decompression bomb protection allows excessive memory allocation (bsc#1270411).
  • CVE-2026-55380: crafted .gd file can trigger excessive C-heap allocation when loaded (bsc#1270412).

Список пакетов

openSUSE Leap 16.0
python313-Pillow-11.3.0-160000.6.1
python313-Pillow-tk-11.3.0-160000.6.1

Ссылки

Описание

Pillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.

Затронутые продукты
openSUSE Leap 16.0:python313-Pillow-11.3.0-160000.6.1
openSUSE Leap 16.0:python313-Pillow-tk-11.3.0-160000.6.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.

Затронутые продукты
openSUSE Leap 16.0:python313-Pillow-11.3.0-160000.6.1
openSUSE Leap 16.0:python313-Pillow-tk-11.3.0-160000.6.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

Затронутые продукты
openSUSE Leap 16.0:python313-Pillow-11.3.0-160000.6.1
openSUSE Leap 16.0:python313-Pillow-tk-11.3.0-160000.6.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Затронутые продукты
openSUSE Leap 16.0:python313-Pillow-11.3.0-160000.6.1
openSUSE Leap 16.0:python313-Pillow-tk-11.3.0-160000.6.1
Ссылки

Описание

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

Затронутые продукты
openSUSE Leap 16.0:python313-Pillow-11.3.0-160000.6.1
openSUSE Leap 16.0:python313-Pillow-tk-11.3.0-160000.6.1
Ссылки