Release date:
2026-09-21 12:24:47 UTC
Description:
* SECURITY UPDATE: arbitrary code execution via the ImageMath.eval
environment parameter (ELSCVE-187962)
- debian/patches/CVE-2023-50447.patch: reject environment keys that
contain "__" or shadow a builtin before they are merged into the
execution namespace in src/PIL/ImageMath.py, so an injected name can
no longer satisfy the expression allowlist. Adds a regression test in
Tests/test_imagemath.py.
- CVE-2023-50447
* SECURITY UPDATE: denial of service via unbounded allocation when
measuring or rendering very long strings
- debian/patches/CVE-2023-44271.patch: add ImageFont.MAX_STRING_LENGTH
and check it at each text entry point in src/PIL/ImageFont.py before
the C layer allocates. Adds a regression test in
Tests/test_imagefont.py.
- CVE-2023-44271
Updated packages:
-
python-pil_5.1.0-1ubuntu0.8+tuxcare.els1_amd64.deb
sha:6c2f7067512dbcadbd1d582620b0e197f5af5ac8
-
python-pil-doc_5.1.0-1ubuntu0.8+tuxcare.els1_all.deb
sha:6dafafc095f163ef90cf907e41ada731e575802d
-
python-pil.imagetk_5.1.0-1ubuntu0.8+tuxcare.els1_amd64.deb
sha:8cb9db596ee8eb0f9eddd8b6f7db8d8e5cd87ff8
-
python3-pil_5.1.0-1ubuntu0.8+tuxcare.els1_amd64.deb
sha:43235a1e1496fdabc77822893fe3e027fd66f650
-
python3-pil.imagetk_5.1.0-1ubuntu0.8+tuxcare.els1_amd64.deb
sha:7ad3b5b4da4d21d044bffd47eef40b9027f8a5ad
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
