python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

python-pillow: Pillow: Denial of Service via crafted BDF font file

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical...

Important: Red Hat Security Advisory: Satellite 6.17.10 Async Update

A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

python-pillow: Pillow: Denial of Service via crafted PCF font data

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing specially crafted PCF font data. This data, when processed, can lead to excessive memory allocation because the library does not properly check for decompression bombs. The primar...

python-pillow: Pillow: Denial of Service via crafted BDF font file

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical...

python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files

A flaw was found in Pillow, a Python imaging library. When processing a specially crafted font file, the library's font compilation function does not adequately check for excessive memory allocation. This oversight allows a remote attacker to trigger an unreasonable consumption of system memory,...

python-pillow: Pillow: Denial of Service via crafted GD 2.x image file

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile.open function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a...

CLSA-2026-1772410256 TuxCare security update for pillow (4 CVEs)

TuxCare rebuilt pillow to address 4 CVEs. Fixed in 8.4.0.post1+tuxcare...

CLSA-2026-1772410261 TuxCare security update for pillow (3 CVEs)

TuxCare rebuilt pillow to address 3 CVEs. Fixed in 9.4.0.post2+tuxcare...

CLSA-2026-1772410263 TuxCare security update for pillow (2 CVEs)

TuxCare rebuilt pillow to address 2 CVEs. Fixed in 9.5.0.post1+tuxcare...

CLSA-2026-1772410267 TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 9.5.0.post2+tuxcare...

Security Bulletin:Pillow Integer Overflow Vulnerability Fixed in Version 12.2.0

Summary Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0. Vulnerability Details...

RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:50336)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50336 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:50319)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50319 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3839 (ALAS-2026-3839)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3839 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image...

RHEL 9 : Satellite 6.17.10 Async Update (Important) (RHSA-2026:50222)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:50222 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-2013)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2013 advisory. Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can s...

MiracleLinux 8 : python-pillow-5.1.1-23.el8_10 (AXSA:2026-1435:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1435:02 advisory. Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59197 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image...

AlmaLinux 8 : python-pillow (ALSA-2026:48021)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:48021 advisory. Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59197 Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image...