Release date:
2026-10-16 15:27:27 UTC
Description:
* SECURITY UPDATE: heap out-of-bounds write via paste box coordinates
near the signed 32-bit integer limits (ELSCVE-233283)
- debian/patches/CVE-2026-59199.patch: compute the paste box
dimensions as int64_t in ImagingPaste() and ImagingFill2() in
src/libImaging/Paste.c. Adds a regression test in
Tests/test_image_paste.py.
- CVE-2026-59199
* SECURITY UPDATE: out-of-bounds read when memory-mapping McIdas AREA
images with an undersized row stride (ELSCVE-233312)
- debian/patches/CVE-2026-54058.patch: raise the row stride to at
least one full row of pixels in PyImaging_MapBuffer() in src/map.c.
Adds a regression test in Tests/test_file_mcidas.py.
- CVE-2026-54058
Updated packages:
-
python-pil_5.1.0-1ubuntu0.8+tuxcare.els2_amd64.deb
sha:a4ae894404824e834cb525dd36573be88d62102e
-
python-pil-doc_5.1.0-1ubuntu0.8+tuxcare.els2_all.deb
sha:2ecbc83ffb2b2a636e75098ead6a50b2274d914b
-
python-pil.imagetk_5.1.0-1ubuntu0.8+tuxcare.els2_amd64.deb
sha:c3f068b24e3a01a4a908d21ee2d3605f199607a2
-
python3-pil_5.1.0-1ubuntu0.8+tuxcare.els2_amd64.deb
sha:39306e54a68371b2901869a3d858c8d7ee168af5
-
python3-pil.imagetk_5.1.0-1ubuntu0.8+tuxcare.els2_amd64.deb
sha:bf8ac3e50f7005668c051330b728484da4f73ed7
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
