Summary
[5.1.1-36]
- CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript
call, potentially leading into RCE
Resolves: RHEL-295960
[5.1.1-35]
- CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix
(FPX) JPEG decoding leads to code execution
Resolves: RHEL-294549
[5.1.1-34]
- CVE-2026-112393 python-pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Resolves: RHEL-293597
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | python3-pillow | 0:5.1.1-36.el8_10 |
| Oracle Linux · 8 | python3-pillow-devel | 0:5.1.1-36.el8_10 |
| Oracle Linux · 8 | python3-pillow-doc | 0:5.1.1-36.el8_10 |
| Oracle Linux · 8 | python3-pillow-tk | 0:5.1.1-36.el8_10 |
Vulnerabilities 3
-
Critical 9.2
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback si…
-
Critical 9.2CVE-2026-112398 Public exploit
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…
-
Critical 9.2CVE-2026-112900 Public exploit
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe abso…