Skip to content
OpenAdvisories
Medium WID-SEC-2026-4243 11 CVEs

Red Hat Enterprise Linux (pillow and aspell): Mehrere Schwachstellen

Published Oct 29, 2026 · Updated Nov 12, 2026 · Revision 10 · de

Vendor: amazon Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Product: Rocky Linux Product: Satellite Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux (pillow and aspell) ausnutzen, um einen Denial of Service Angriff durchzuführen oder beliebigen Programmcode auszuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 11

  • High 8.7
    CVE-2026-112397

    Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112402

    Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112405

    Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0

    Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112406

    Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112892

    Pillow: MSP RLE decoder expands a tiny file into unbounded memory

    Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112894

    Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.7
    CVE-2026-112895

    Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…

    python-pillow Pillow open-webui kserve-storage-controller Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-112392

    Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images

    Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • High 8.2
    CVE-2026-96640

    Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2026-112391

    Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()

    Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…

    python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  • Medium 5.9
    CVE-2026-103658

    GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in it…

    GNU Aspell aspell aspell Debian Ubuntu Azure Linux

Revision history

  1. #10

    Neue Updates von SUSE und Red Hat aufgenommen

  2. #9

    Neue Updates von SUSE und Red Hat aufgenommen

  3. #8

    Neue Updates von SUSE und openSUSE aufgenommen

  4. #7

    Neue Updates von Red Hat, Amazon und SUSE aufgenommen

  5. #6

    Neue Updates von openSUSE aufgenommen

  6. #5

    Neue Updates von Red Hat aufgenommen

  7. #4

    Neue Updates von Red Hat aufgenommen

  8. #3

    Neue Updates von SUSE aufgenommen

  9. #2

    Neue Updates von Oracle Linux und Fedora aufgenommen

  10. #1

    Initiale Fassung

References