SUSE-SU-2026:5038-1

Dashboard / Vulnerabilities / SUSE-SU-2026:5038-1

SUSE-SU-2026:5038-1

Summary: Security update for python-Pillow

Details: This update for python-Pillow fixes the following issues: - CVE-2026-96636: decompression-bomb protection bypass via multi-frame `seek()` in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in `SpiderImagePlugin.seek()` leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: `TarIO` negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: `P;2L` and `P;4L` decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112397: out-of-bounds access in `_imagingmorph` on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in `ImagingJpegDecode` allows for code execution (bsc#1286405). - CVE-2026-112405: NULL pointer dereference in `Image.merge` via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in `PdfParser.rewrite_pages` on page tree `Parent` cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder `ColorMap` plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: `TiffDecode` returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112899: EPS `load(scale)` lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in `XbmImagePlugin` can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).

References: https://www.suse.com/support/update/announcement/2026/suse-su-20265038-1/, https://bugzilla.suse.com/1286256, https://bugzilla.suse.com/1286273, https://bugzilla.suse.com/1286287, https://bugzilla.suse.com/1286311, https://bugzilla.suse.com/1286314, https://bugzilla.suse.com/1286325, https://bugzilla.suse.com/1286368, https://bugzilla.suse.com/1286370, https://bugzilla.suse.com/1286372, https://bugzilla.suse.com/1286381, https://bugzilla.suse.com/1286396, https://bugzilla.suse.com/1286397, https://bugzilla.suse.com/1286398, https://bugzilla.suse.com/1286400, https://bugzilla.suse.com/1286401, https://bugzilla.suse.com/1286402, https://bugzilla.suse.com/1286403, https://bugzilla.suse.com/1286404, https://bugzilla.suse.com/1286405, https://bugzilla.suse.com/1286406, https://bugzilla.suse.com/1286408, https://bugzilla.suse.com/1286411, https://bugzilla.suse.com/1286489, https://bugzilla.suse.com/1286796, https://bugzilla.suse.com/1286797, https://bugzilla.suse.com/1286798, https://bugzilla.suse.com/1286801, https://bugzilla.suse.com/1286802, https://bugzilla.suse.com/1286804, https://www.suse.com/security/cve/CVE-2026-112390, https://www.suse.com/security/cve/CVE-2026-112391, https://www.suse.com/security/cve/CVE-2026-112392, https://www.suse.com/security/cve/CVE-2026-112393, https://www.suse.com/security/cve/CVE-2026-112394, https://www.suse.com/security/cve/CVE-2026-112397, https://www.suse.com/security/cve/CVE-2026-112398, https://www.suse.com/security/cve/CVE-2026-112399, https://www.suse.com/security/cve/CVE-2026-112400, https://www.suse.com/security/cve/CVE-2026-112401, https://www.suse.com/security/cve/CVE-2026-112402, https://www.suse.com/security/cve/CVE-2026-112403, https://www.suse.com/security/cve/CVE-2026-112405, https://www.suse.com/security/cve/CVE-2026-112406, https://www.suse.com/security/cve/CVE-2026-112891, https://www.suse.com/security/cve/CVE-2026-112892, https://www.suse.com/security/cve/CVE-2026-112894, https://www.suse.com/security/cve/CVE-2026-112895, https://www.suse.com/security/cve/CVE-2026-112896, https://www.suse.com/security/cve/CVE-2026-112897, https://www.suse.com/security/cve/CVE-2026-112899, https://www.suse.com/security/cve/CVE-2026-112900, https://www.suse.com/security/cve/CVE-2026-112901, https://www.suse.com/security/cve/CVE-2026-112902, https://www.suse.com/security/cve/CVE-2026-96636, https://www.suse.com/security/cve/CVE-2026-96637, https://www.suse.com/security/cve/CVE-2026-96640, https://www.suse.com/security/cve/CVE-2026-96641, https://www.suse.com/security/cve/CVE-2026-96642