Your message dated Sun, 19 Jul 2026 11:34:08 +0000
with message-id <[email protected]>
and subject line Bug#1142274: fixed in pillow 12.3.0-1
has caused the Debian Bug report #1142274,
regarding pillow: CVE-2026-54058 CVE-2026-54059 CVE-2026-54060 CVE-2026-55379
CVE-2026-55380 CVE-2026-59197 CVE-2026-59198 CVE-2026-59199 CVE-2026-59200
CVE-2026-59203 CVE-2026-59204 CVE-2026-59205
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142274: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142274
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: pillow
Version: 12.2.0-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for pillow.
For unstable it is probably just best to move to 12.3.0 rather than
picking individual fixes so we get the version included in forky.
CVE-2026-54058[0]:
| Pillow is a Python imaging library. Prior to 12.3.0, when Pillow
| loads an uncompressed McIdas AREA image from a filename through the
| mmap raw codec path, attacker-controlled header words can set a row
| stride smaller than the natural row width, causing pixel access such
| as Image.tobytes(), getpixel, convert, or save to read beyond the
| mapped region and disclose adjacent process memory or fault. This
| issue is fixed in version 12.3.0.
CVE-2026-54059[1]:
| Pillow is a Python imaging library. Prior to 12.3.0,
| PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the
| PCF METRICS section and passed them directly to Image.frombytes()
| without calling Image._decompression_bomb_check(), allowing crafted
| PCF font data to cause excessive memory allocation. This issue is
| fixed in version 12.3.0.
CVE-2026-54060[2]:
| Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py
| FontFile.compile() assembled per-glyph images into a combined bitmap
| with Image.new("1", (xsize, ysize)) without calling
| Image._decompression_bomb_check(), allowing a font to trigger
| excessive allocation during conversion or saving. This issue is
| fixed in version 12.3.0.
CVE-2026-55379[3]:
| Pillow is a Python imaging library. Prior to 12.3.0,
| PIL/BdfFontFile.py bdf_char() read the BBX width and height field
| from a BDF font file and passed attacker-controlled dimensions to
| Image.new() without calling Image._decompression_bomb_check(),
| bypassing Pillow's documented decompression bomb protection and
| allowing excessive memory allocation. This issue is fixed in version
| 12.3.0.
CVE-2026-55380[4]:
| Pillow is a Python imaging library. Prior to 12.3.0,
| PIL/GdImageFile.py GdImageFile._open() read image dimensions from
| the GD 2.x header and stored them in self._size without calling
| Image._decompression_bomb_check(), allowing a crafted .gd file to
| trigger excessive C-heap allocation when loaded. This issue is fixed
| in version 12.3.0.
CVE-2026-59197[5]:
| Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public
| rank-filter API can trigger a native heap out-of-bounds write when
| given a very large odd filter size because
| ImageFilter.RankFilter.filter() calls image.expand(size // 2, size
| // 2) before rank-filter size validation and ImagingExpand()
| computes output dimensions with unchecked signed int arithmetic.
| This issue is fixed in version 12.3.0.
CVE-2026-59198[6]:
| Pillow is a Python imaging library. From 5.2.0 until 12.3.0,
| Pillow's TGA RLE encoder reads past its packed row buffer when
| saving a mode 1 image with TGA RLE compression, allowing adjacent
| process heap bytes to be copied into the generated TGA file. This
| issue is fixed in version 12.3.0.
CVE-2026-59199[7]:
| Pillow is a Python imaging library. Prior to 12.3.0, Pillow public
| image coordinate APIs can trigger a native heap out-of-bounds write
| when given coordinates near the signed 32-bit integer limits in
| Image.paste(), Image.crop(), or Image.alpha_composite(). This issue
| is fixed in version 12.3.0.
CVE-2026-59200[8]:
| Pillow is a Python imaging library. From 5.1.0 until 12.3.0,
| PdfParser.PdfStream.decode() in PIL/PdfParser.py calls
| zlib.decompress() with bufsize set to the PDF stream Length field
| without bounding the decompressed output size, allowing a crafted
| FlateDecode PDF stream to exhaust memory from a small file. This
| issue is fixed in version 12.3.0.
CVE-2026-59203[9]:
| Pillow is a Python imaging library. From 12.0.0 through 12.2.0,
| Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte
| count in the %%BeginBinary directive, allowing a crafted EPS file to
| cause Image.open() to seek backwards to the same directive and parse
| it repeatedly in an infinite loop. This issue is fixed in version
| 12.3.0.
CVE-2026-59204[10]:
| Pillow is a Python imaging library. From 8.2.0 through 12.2.0,
| src/libImaging/Jpeg2KDecode.c accumulates total_component_width
| across every tile in a JPEG2000 image instead of recomputing it per
| tile, allowing a crafted tiled JPEG2000 file to force substantially
| higher transient memory usage and trigger out-of-memory failures
| during decoding. This issue is fixed in version 12.3.0.
CVE-2026-59205[11]:
| Pillow is a Python imaging library. Prior to 12.3.0, Pillow's
| ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger
| controlled native heap corruption when the caller supplies an output
| image whose mode does not match the transform's declared output
| mode. This issue is fixed in version 12.3.0.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-54058
https://www.cve.org/CVERecord?id=CVE-2026-54058
[1] https://security-tracker.debian.org/tracker/CVE-2026-54059
https://www.cve.org/CVERecord?id=CVE-2026-54059
[2] https://security-tracker.debian.org/tracker/CVE-2026-54060
https://www.cve.org/CVERecord?id=CVE-2026-54060
[3] https://security-tracker.debian.org/tracker/CVE-2026-55379
https://www.cve.org/CVERecord?id=CVE-2026-55379
[4] https://security-tracker.debian.org/tracker/CVE-2026-55380
https://www.cve.org/CVERecord?id=CVE-2026-55380
[5] https://security-tracker.debian.org/tracker/CVE-2026-59197
https://www.cve.org/CVERecord?id=CVE-2026-59197
[6] https://security-tracker.debian.org/tracker/CVE-2026-59198
https://www.cve.org/CVERecord?id=CVE-2026-59198
[7] https://security-tracker.debian.org/tracker/CVE-2026-59199
https://www.cve.org/CVERecord?id=CVE-2026-59199
[8] https://security-tracker.debian.org/tracker/CVE-2026-59200
https://www.cve.org/CVERecord?id=CVE-2026-59200
[9] https://security-tracker.debian.org/tracker/CVE-2026-59203
https://www.cve.org/CVERecord?id=CVE-2026-59203
[10] https://security-tracker.debian.org/tracker/CVE-2026-59204
https://www.cve.org/CVERecord?id=CVE-2026-59204
[11] https://security-tracker.debian.org/tracker/CVE-2026-59205
https://www.cve.org/CVERecord?id=CVE-2026-59205
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: pillow
Source-Version: 12.3.0-1
Done: Matthias Klose <[email protected]>
We believe that the bug you reported is fixed in the latest version of
pillow, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Matthias Klose <[email protected]> (supplier of updated pillow package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 19 Jul 2026 13:02:34 +0200
Source: pillow
Architecture: source
Version: 12.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Matthias Klose <[email protected]>
Changed-By: Matthias Klose <[email protected]>
Closes: 1142274
Changes:
pillow (12.3.0-1) unstable; urgency=medium
.
* New upstream version.
- Addresses CVE-2026-54058, CVE-2026-54059, CVE-2026-54060,
CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59198,
CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204,
CVE-2026-59205. Closes: #1142274.
Checksums-Sha1:
1f46892fe16a3ce4d1e351e79f5175bcab5e2e2c 2486 pillow_12.3.0-1.dsc
70de178b826bc68af20234d0eb2d59a3e35ad58b 37255276 pillow_12.3.0.orig.tar.xz
9e99ce292f260eb04a2b07cfcb9fbbb4a810d26e 20664 pillow_12.3.0-1.debian.tar.xz
12f8e9b43e360c2a8b4f1adfaf02ce708f1d6229 7290 pillow_12.3.0-1_source.buildinfo
Checksums-Sha256:
ddfbf3294e55ac0d6ee31582f9d48aeb7bd99df8b136afa96d4326286c530dd2 2486
pillow_12.3.0-1.dsc
c8d424981f30379f096a1e7415f0bbaec1ef06f6563392df0de5292aae500a03 37255276
pillow_12.3.0.orig.tar.xz
6ae75be2ec3efa6c65812badf4db08e3f4ff1838e45603f3a1879ae6b706e977 20664
pillow_12.3.0-1.debian.tar.xz
0c276139851813fcfb8848d12d7ad9ac5b4e8726a29abbd8a845e68e87ec88ec 7290
pillow_12.3.0-1_source.buildinfo
Files:
ff183996e44903fdbe52837486ff9a2b 2486 python optional pillow_12.3.0-1.dsc
b17540754d790ac75c1077ea8d3da5cb 37255276 python optional
pillow_12.3.0.orig.tar.xz
bb627f8ef51c30c3e4eaf498c7d9bca1 20664 python optional
pillow_12.3.0-1.debian.tar.xz
4e0c91c588569584704c6742a89c478d 7290 python optional
pillow_12.3.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCgAuFiEE1WVxuIqLuvFAv2PWvX6qYHePpvUFAmpcsf8QHGRva29AZGVi
aWFuLm9yZwAKCRC9fqpgd4+m9c6nEACF7unAsGajx2mjugPPNBMOt929e7FhuEOI
U3un/2rri1Q2FoyUbbPdAtugAYZxpqB1DsFMildEPbuWzgmOTQsvLNuvJihgs5nA
yLEkr5G9SpqIkErgajNo7z09NwkNNVg5R5EBclaEPQQTT3jUI0WV34JxAKLmyRlX
1a9BpltdIeTgM+UZ/yiKkJuL9i7if5OBIoamnuOH/3CK+V8o8GuRx5aRglFzNIXV
q53b2TKupZRCfn3xQiHP07zofsd4n47lPv5Aodz1oHtbsvXFmYU+tQYHpLbcMtPW
tHNq3c6wGbxJ0YPOntDD7E4oeZSUKxAP0eui8cq2v4x0EJeXigBa4K7UAJums6Fp
V6aZpNtcZb/x+mfXNRLD9Y8RrMKtTc+G61nndJlUI4vDF4Ff3aAsdAiqAf7Q7NTi
H87SgQakUpgDLZyh4Yindgct/s6KzL8Oh/NYe8Hnezzsa5zspx9SX23NSyEGRGBF
rFO+7YTCNb3ZfTkPPpNzLt5sw9mlf7gsHhhB8HPqBw4cH0AJ+xcrIGg3v3Pv1BbL
DBKUnkea4Xvsh9o02UBcSKJvpx9Ni/Dy1vdUqf75xIaY7GQVr5M9fsb3FSWbGylU
LtwHaAYg6fzGyvFXV0J10ankQQGczCBnjIcR5ewfTtL/AGf4lRl0pMr5gOa2MkxK
fWybKZhREw==
=+BvH
-----END PGP SIGNATURE-----
pgpu2VsmKGPA6.pgp
Description: PGP signature
--- End Message ---
