OESA-2026-4663

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4663

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4663.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4663

Upstream

CVE-2026-112398

Published

2026-11-04T13:54:13Z

Modified

2026-11-04T14:00:05Z

Severity

9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

python-pillow security update

Details

Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging \ Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift. of CVE-2022-22815,CVE-2022-22816)

Security Fix(es):

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.(CVE-2026-112398)

Database specific

{
    "severity": "Critical"
}

References

Affected packages

openEuler:22.03-LTS-SP4 / python-pillow

Package

Name: python-pillow
Purl: pkg:rpm/openEuler/python-pillow&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.0.1-17.oe2203sp4

Ecosystem specific

{
    "aarch64": [
        "python-pillow-debuginfo-9.0.1-17.oe2203sp4.aarch64.rpm",
        "python-pillow-debugsource-9.0.1-17.oe2203sp4.aarch64.rpm",
        "python3-pillow-9.0.1-17.oe2203sp4.aarch64.rpm",
        "python3-pillow-devel-9.0.1-17.oe2203sp4.aarch64.rpm",
        "python3-pillow-qt-9.0.1-17.oe2203sp4.aarch64.rpm",
        "python3-pillow-tk-9.0.1-17.oe2203sp4.aarch64.rpm"
    ],
    "noarch": [
        "python3-pillow-help-9.0.1-17.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "python-pillow-9.0.1-17.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "python-pillow-debuginfo-9.0.1-17.oe2203sp4.x86_64.rpm",
        "python-pillow-debugsource-9.0.1-17.oe2203sp4.x86_64.rpm",
        "python3-pillow-9.0.1-17.oe2203sp4.x86_64.rpm",
        "python3-pillow-devel-9.0.1-17.oe2203sp4.x86_64.rpm",
        "python3-pillow-qt-9.0.1-17.oe2203sp4.x86_64.rpm",
        "python3-pillow-tk-9.0.1-17.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4663.json"