Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-112902: A flaw was found in Pillow. When saving an image in the TIFF format, Pillow incorrectly forwards unknown metadata tags to the underlying image processing library. A remote attacker could exploit this flaw by providing a specially crafted image containing malicious metadata to an application that processes and re-saves it. Successful exploitation allows the attacker to read out-of-bounds memory, leading to the disclosure of sensitive process memory or causing the application to crash, resulting in a Denial of Service (DoS).
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python-pillow | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
| Amazon Linux · 2 | python-pillow-debuginfo | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
| Amazon Linux · 2 | python-pillow-devel | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
| Amazon Linux · 2 | python-pillow-doc | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
| Amazon Linux · 2 | python-pillow-sane | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
| Amazon Linux · 2 | python-pillow-tk | 0:2.0.0-23.gitd1c6db8.amzn2.0.22 |
Vulnerabilities 1
-
High 8.3
Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags
Pillow is a Python imaging library. In versions through 12.3.0, the libtiff TIFF encoder can pass arguments to TIFFSetField() that do not match libtiff’s definition of the corresponding tag. When an application saves attacker-controlled image metadata throu…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-112902.html