sphinxmark (0.1.15) potentially affected by CVE-2026-112392 via pillow (3.4.1)

pillow PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - sphinxmark 0.1.15 Source cves: CVE-2026-112392 Source advisory: OSV:PYSEC-2026-4326...

170051277-trab-final-gces (>=0.3.0, <=0.5.0), 2022-2-gces-ifpf (0.3.0) +1331 more potentially affected by CVE-2026-112397 via pillow (9.5.0)

pillow PYPI version 9.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 170051277-trab-final-gces =0.3.0, =0.1.0, =0.1.0, =2.0.1, =0.1.4, =1.2.5, =0.1.0, =1.2.0, =1.10.3, =0.61.9b59, =1.3.1 and more Source cves:...

al-for-design (0.0.1), autogluon (>=0.0.5, <=0.1.0b20210209) +48 more potentially affected by CVE-2026-112392 via pillow (6.2.1)

pillow PYPI version 6.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - al-for-design 0.0.1 - autogluon =0.0.5, =0.0.15b20201014, =0.0.15b20201024, =0.0.16b20210114, =0.0.15b20201024, =0.0.121, =0.0.1, =0.0.1, =0.0.1,...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 3lc (>=2.12.0, <=2.22.0) +2457 more potentially affected by CVE-2026-112392 via pillow (10.4.0)

pillow PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 11x-wagtail-blog =0.0.0, =2.12.0, =0.1.0, =0.1.3, =0.3.0, =0.1.3, =0.1.0, =0.1.4, =0.3.0, =0.2.1, =0.2.0, =0.0.1, =0.0.0, =0.0.9 and more Source...

groupyapi (0.7.1) potentially affected by CVE-2026-112397 via pillow (2.5.3)

pillow PYPI version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - groupyapi 0.7.1 Source cves: CVE-2026-112397 Source advisory: OSV:PYSEC-2026-4329...

UBUNTU-CVE-2026-112893

Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FTLoadGlyph fails, cleanup may call FTDoneGlyph on an uninitialized or stale glyph variable. An attacker can supply a malformed font as...

UBUNTU-CVE-2026-112897

Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The decodeStrip and decodeTile buffers can be larger than the bytes written by libtiff, but Pillow conver...

UBUNTU-CVE-2026-112399

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and background disposal or first-frame OPPREVIO...

UBUNTU-CVE-2026-112892

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an...

UBUNTU-CVE-2026-112898

Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize uses an empty palette. ImagingPaletteCacheUpdate leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as...

UBUNTU-CVE-2026-112406

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewritepages follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to...

UBUNTU-CVE-2026-112400

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile.seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and...

UBUNTU-CVE-2026-112405

Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narrower multiband image. A crafted IPTC fil...

UBUNTU-CVE-2026-112894

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall enabled. PdfParser.nextobjectid repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can suppl...

UBUNTU-CVE-2026-112900

Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a...

UBUNTU-CVE-2026-112401

Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow performs quadratic copying while parsing GIF comments. GifImageFile.seek repeatedly appends immutable bytes for comment sub-blocks and multiple comment extensions, and frame zero is parsed during Image.open. An attacker can submi...

UBUNTU-CVE-2026-112895

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer chains with only an exact...

UBUNTU-CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

UBUNTU-CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

UBUNTU-CVE-2026-112396

Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in...