CLSA-2026-1789993475
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789993475.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789993475
- Upstream
CVE (2)
- Published
- 2026-09-21T12:24:47Z
- Modified
- 2026-10-26T09:32:04Z
- Summary
- Fix CVE(s): CVE-2023-44271, CVE-2023-50447
- Details
-
- SECURITY UPDATE: arbitrary code execution via the ImageMath.eval
environment parameter (ELSCVE-187962)
- debian/patches/CVE-2023-50447.patch: reject environment keys that contain "__" or shadow a builtin before they are merged into the execution namespace in src/PIL/ImageMath.py, so an injected name can no longer satisfy the expression allowlist. Adds a regression test in Tests/test_imagemath.py.
- CVE-2023-50447
- SECURITY UPDATE: denial of service via unbounded allocation when
measuring or rendering very long strings
- debian/patches/CVE-2023-44271.patch: add ImageFont.MAX_STRING_LENGTH and check it at each text entry point in src/PIL/ImageFont.py before the C layer allocates. Adds a regression test in Tests/test_imagefont.py.
- CVE-2023-44271
- SECURITY UPDATE: arbitrary code execution via the ImageMath.eval
environment parameter (ELSCVE-187962)
- References
Affected packages
TuxCare:Ubuntu:18.04 / python-pil
Package
- Name
- python-pil
- Purl
- pkg:deb/tuxcare/python-pil?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / python-pil-doc
Package
- Name
- python-pil-doc
- Purl
- pkg:deb/tuxcare/python-pil-doc?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / python-pil.imagetk
Package
- Name
- python-pil.imagetk
- Purl
- pkg:deb/tuxcare/python-pil.imagetk?distro=ubuntu-18.04
TuxCare:Ubuntu:18.04 / python3-pil
Package
- Name
- python3-pil
- Purl
- pkg:deb/tuxcare/python3-pil?distro=ubuntu-18.04