public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/python-pillow] f43: Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798
@ 2026-07-08 7:21 Sandro Mani
0 siblings, 0 replies; only message in thread
From: Sandro Mani @ 2026-07-08 7:21 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/python-pillow
Branch : f43
Commit : 86a992aa455ddb9455a10da1e79f6785a81f1f85
Author : Sandro Mani <manisandro@gmail.com>
Date : 2026-07-08T09:21:04+02:00
Stats : +225/-12 in 7 file(s)
URL : https://src.fedoraproject.org/rpms/python-pillow/c/86a992aa455ddb9455a10da1e79f6785a81f1f85?branch=f43
Log:
Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798
---
diff --git a/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch b/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
new file mode 100644
index 0000000..b698e37
--- /dev/null
+++ b/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
@@ -0,0 +1,134 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/BdfFontFile.py Pillow-11.3.0-new/src/PIL/BdfFontFile.py
+--- Pillow-11.3.0/src/PIL/BdfFontFile.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/BdfFontFile.py 2026-07-08 00:44:43.678121242 +0200
+@@ -69,6 +69,7 @@ def bdf_char(
+ # and x and y displacement (BBxoff0, BByoff0)
+ # of the lower left corner from the origin of the character.
+ width, height, x_disp, y_disp = (int(p) for p in props["BBX"].split())
++ Image._decompression_bomb_check((width, height))
+
+ # The word DWIDTH
+ # followed by the width in x and y of the character in device pixels.
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/FontFile.py Pillow-11.3.0-new/src/PIL/FontFile.py
+--- Pillow-11.3.0/src/PIL/FontFile.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/FontFile.py 2026-07-08 00:44:43.678503853 +0200
+@@ -74,7 +74,7 @@ class FontFile:
+ if glyph:
+ d, dst, src, im = glyph
+ h = max(h, src[3] - src[1])
+- w = w + (src[2] - src[0])
++ w += src[2] - src[0]
+ if w > WIDTH:
+ lines += 1
+ w = src[2] - src[0]
+@@ -89,6 +89,7 @@ class FontFile:
+ self.ysize = h
+
+ # paste glyphs into bitmap
++ Image._decompression_bomb_check((xsize, ysize))
+ self.bitmap = Image.new("1", (xsize, ysize))
+ self.metrics: list[
+ tuple[tuple[int, int], tuple[int, int, int, int], tuple[int, int, int, int]]
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/PcfFontFile.py Pillow-11.3.0-new/src/PIL/PcfFontFile.py
+--- Pillow-11.3.0/src/PIL/PcfFontFile.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/PcfFontFile.py 2026-07-08 00:44:43.678781879 +0200
+@@ -166,6 +166,7 @@ class PcfFontFile(FontFile.FontFile):
+ descent = i8(fp.read(1)) - 128
+ xsize = right - left
+ ysize = ascent + descent
++ Image._decompression_bomb_check((xsize, ysize))
+ append((xsize, ysize, left, right, width, ascent, descent, 0))
+
+ else:
+@@ -179,6 +180,7 @@ class PcfFontFile(FontFile.FontFile):
+ attributes = i16(fp.read(2))
+ xsize = right - left
+ ysize = ascent + descent
++ Image._decompression_bomb_check((xsize, ysize))
+ append((xsize, ysize, left, right, width, ascent, descent, attributes))
+
+ return metrics
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_font_bdf.py Pillow-11.3.0-new/Tests/test_font_bdf.py
+--- Pillow-11.3.0/Tests/test_font_bdf.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_font_bdf.py 2026-07-08 00:44:43.679072737 +0200
+@@ -4,7 +4,7 @@ import io
+
+ import pytest
+
+-from PIL import BdfFontFile, FontFile
++from PIL import BdfFontFile, FontFile, Image
+
+ filename = "Tests/images/courB08.bdf"
+
+@@ -24,6 +24,14 @@ def test_zero_width_chars() -> None:
+ BdfFontFile.BdfFontFile(io.BytesIO(data))
+
+
++def test_decompression_bomb() -> None:
++ with open(filename, "rb") as fp:
++ data = fp.read()
++ b = io.BytesIO(data.replace(b"BBX 1 1", b"BBX 13378 13378"))
++ with pytest.raises(Image.DecompressionBombError):
++ BdfFontFile.BdfFontFile(b)
++
++
+ def test_invalid_file() -> None:
+ with open("Tests/images/flower.jpg", "rb") as fp:
+ with pytest.raises(SyntaxError):
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_fontfile.py Pillow-11.3.0-new/Tests/test_fontfile.py
+--- Pillow-11.3.0/Tests/test_fontfile.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_fontfile.py 2026-07-08 00:44:43.679324566 +0200
+@@ -20,6 +20,13 @@ def test_compile() -> None:
+ assert font.ysize == 2
+
+
++def test_decompression_bomb() -> None:
++ font = FontFile.FontFile()
++ font.glyph[0] = ((0, 0), (0, 0, 0, 0), (0, 0, 10000, 10000), Image.new("L", (0, 0)))
++ with pytest.raises(Image.DecompressionBombError):
++ font.compile()
++
++
+ def test_save(tmp_path: Path) -> None:
+ tempname = str(tmp_path / "temp.pil")
+
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_font_pcf.py Pillow-11.3.0-new/Tests/test_font_pcf.py
+--- Pillow-11.3.0/Tests/test_font_pcf.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_font_pcf.py 2026-07-08 00:44:43.679576479 +0200
+@@ -1,12 +1,13 @@
+ from __future__ import annotations
+
+ import os
++from io import BytesIO
+ from pathlib import Path
+ from typing import AnyStr
+
+ import pytest
+
+-from PIL import FontFile, Image, ImageDraw, ImageFont, PcfFontFile
++from PIL import FontFile, Image, ImageDraw, ImageFont, PcfFontFile, _binary
+
+ from .helper import (
+ assert_image_equal_tofile,
+@@ -108,3 +109,21 @@ def test_high_characters(request: pytest
+ _test_high_characters(request, tmp_path, message)
+ # accept bytes instances.
+ _test_high_characters(request, tmp_path, message.encode("latin1"))
++
++
++def test_decompression_bomb() -> None:
++ with open(fontname, "rb") as fp:
++ data = fp.read()
++ b = BytesIO(
++ data[:900]
++ + _binary.o32le(0) # jumbo format
++ + _binary.o32le(1) # number of metrics
++ + _binary.o16le(0) # left
++ + _binary.o16le(65535) # right
++ + _binary.o16le(0) # width
++ + _binary.o16le(0) # ascent
++ + _binary.o16le(65535) # descent
++ + _binary.o16le(0) # attributes
++ )
++ with pytest.raises(Image.DecompressionBombError):
++ PcfFontFile.PcfFontFile(b)
diff --git a/3cb854e8b2bab43f40e342e665f9340d861aa628.patch b/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
index 194b9a5..8305006 100644
--- a/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
+++ b/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/FitsImagePlugin.py Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py
--- Pillow-11.3.0/src/PIL/FitsImagePlugin.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py 2026-04-18 08:15:14.428095481 +0200
++++ Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py 2026-07-08 00:44:43.401615913 +0200
@@ -128,17 +128,18 @@ class FitsGzipDecoder(ImageFile.PyDecode
def decode(self, buffer: bytes | Image.SupportsArrayInterface) -> tuple[int, int]:
diff --git a/88194166691b7b603529b8b036ab3ab9cedd2de4.patch b/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
new file mode 100644
index 0000000..7983057
--- /dev/null
+++ b/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
@@ -0,0 +1,24 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/ImageShow.py Pillow-11.3.0-new/src/PIL/ImageShow.py
+--- Pillow-11.3.0/src/PIL/ImageShow.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/ImageShow.py 2026-07-08 00:44:43.819636918 +0200
+@@ -131,6 +131,7 @@ class WindowsViewer(Viewer):
+ options = {"compress_level": 1, "save_all": True}
+
+ def get_command(self, file: str, **options: Any) -> str:
++ file = file.replace("%", '"%"')
+ return (
+ f'start "Pillow" /WAIT "{file}" '
+ "&& ping -n 4 127.0.0.1 >NUL "
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_imageshow.py Pillow-11.3.0-new/Tests/test_imageshow.py
+--- Pillow-11.3.0/Tests/test_imageshow.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_imageshow.py 2026-07-08 00:44:43.820045572 +0200
+@@ -107,6 +107,9 @@ def test_viewers(viewer: ImageShow.Viewe
+ except NotImplementedError:
+ pass
+
++ # Check that percentages are escaped
++ assert "%" not in viewer.get_command("%").replace('""%""', "")
++
+
+ def test_ipythonviewer() -> None:
+ pytest.importorskip("IPython", reason="IPython not installed")
diff --git a/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch b/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
index d6b36e3..3138bdf 100644
--- a/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
+++ b/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
@@ -1,6 +1,6 @@
-diff -rupN --no-dereference Pillow-11.1.0/src/decode.c Pillow-11.1.0-new/src/decode.c
---- Pillow-11.1.0/src/decode.c 2025-01-02 06:00:59.000000000 +0100
-+++ Pillow-11.1.0-new/src/decode.c 2026-02-14 19:03:46.593414472 +0100
+diff -rupN --no-dereference Pillow-11.3.0/src/decode.c Pillow-11.3.0-new/src/decode.c
+--- Pillow-11.3.0/src/decode.c 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/decode.c 2026-07-08 00:44:43.254138224 +0200
@@ -186,7 +186,8 @@ _setimage(ImagingDecoderObject *decoder,
state->ysize = y1 - y0;
}
@@ -11,10 +11,10 @@ diff -rupN --no-dereference Pillow-11.1.0/src/decode.c Pillow-11.1.0-new/src/dec
state->ysize <= 0 || state->ysize + state->yoff > (int)im->ysize) {
PyErr_SetString(PyExc_ValueError, "tile cannot extend outside image");
return NULL;
-diff -rupN --no-dereference Pillow-11.1.0/src/encode.c Pillow-11.1.0-new/src/encode.c
---- Pillow-11.1.0/src/encode.c 2025-01-02 06:00:59.000000000 +0100
-+++ Pillow-11.1.0-new/src/encode.c 2026-02-14 19:03:46.593719582 +0100
-@@ -253,7 +253,8 @@ _setimage(ImagingEncoderObject *encoder,
+diff -rupN --no-dereference Pillow-11.3.0/src/encode.c Pillow-11.3.0-new/src/encode.c
+--- Pillow-11.3.0/src/encode.c 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/encode.c 2026-07-08 00:44:43.254804101 +0200
+@@ -254,7 +254,8 @@ _setimage(ImagingEncoderObject *encoder,
state->ysize = y1 - y0;
}
diff --git a/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch b/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
new file mode 100644
index 0000000..b4921e4
--- /dev/null
+++ b/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
@@ -0,0 +1,45 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/GdImageFile.py Pillow-11.3.0-new/src/PIL/GdImageFile.py
+--- Pillow-11.3.0/src/PIL/GdImageFile.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/GdImageFile.py 2026-07-08 00:44:43.541134873 +0200
+@@ -29,7 +29,7 @@ from __future__ import annotations
+
+ from typing import IO
+
+-from . import ImageFile, ImagePalette, UnidentifiedImageError
++from . import Image, ImageFile, ImagePalette, UnidentifiedImageError
+ from ._binary import i16be as i16
+ from ._binary import i32be as i32
+ from ._typing import StrOrBytesPath
+@@ -58,6 +58,7 @@ class GdImageFile(ImageFile.ImageFile):
+
+ self._mode = "P"
+ self._size = i16(s, 2), i16(s, 4)
++ Image._decompression_bomb_check(self.size)
+
+ true_color = s[6]
+ true_color_offset = 2 if true_color else 0
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_file_gd.py Pillow-11.3.0-new/Tests/test_file_gd.py
+--- Pillow-11.3.0/Tests/test_file_gd.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_file_gd.py 2026-07-08 00:44:43.541726407 +0200
+@@ -2,7 +2,7 @@ from __future__ import annotations
+
+ import pytest
+
+-from PIL import GdImageFile, UnidentifiedImageError
++from PIL import GdImageFile, Image, UnidentifiedImageError, _binary
+
+ from .helper import assert_image_similar_tofile
+
+@@ -21,6 +21,12 @@ def test_bad_mode() -> None:
+ GdImageFile.open(TEST_GD_FILE, "bad mode")
+
+
++def test_decompression_bomb() -> None:
++ b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000))
++ with pytest.raises(Image.DecompressionBombError):
++ GdImageFile.open(b)
++
++
+ def test_invalid_file() -> None:
+ invalid_file = "Tests/images/flower.jpg"
+
diff --git a/pillow_mingw.patch b/pillow_mingw.patch
index 0234b96..6e67d7d 100644
--- a/pillow_mingw.patch
+++ b/pillow_mingw.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/setup.py Pillow-11.3.0-new/setup.py
--- Pillow-11.3.0/setup.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/setup.py 2026-02-14 20:33:50.664889730 +0100
++++ Pillow-11.3.0-new/setup.py 2026-07-08 00:44:43.116613779 +0200
@@ -144,7 +144,7 @@ class RequiredDependencyException(Except
pass
@@ -66,7 +66,7 @@ diff -rupN --no-dereference Pillow-11.3.0/setup.py Pillow-11.3.0-new/setup.py
build_ext.build_extensions(self)
diff -rupN --no-dereference Pillow-11.3.0/src/libImaging/ImPlatform.h Pillow-11.3.0-new/src/libImaging/ImPlatform.h
--- Pillow-11.3.0/src/libImaging/ImPlatform.h 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/libImaging/ImPlatform.h 2026-02-14 20:33:50.665283420 +0100
++++ Pillow-11.3.0-new/src/libImaging/ImPlatform.h 2026-07-08 00:44:43.117079889 +0200
@@ -29,7 +29,7 @@
#if defined(_WIN32) || defined(__CYGWIN__) /* WIN */
@@ -78,7 +78,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/libImaging/ImPlatform.h Pillow-11.
#undef _WIN64
diff -rupN --no-dereference Pillow-11.3.0/src/Tk/tkImaging.c Pillow-11.3.0-new/src/Tk/tkImaging.c
--- Pillow-11.3.0/src/Tk/tkImaging.c 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/Tk/tkImaging.c 2026-02-14 20:33:50.665518654 +0100
++++ Pillow-11.3.0-new/src/Tk/tkImaging.c 2026-07-08 00:44:43.117386822 +0200
@@ -321,7 +321,7 @@ load_tkinter_funcs(void) {
/* Allocate module handlers array */
diff --git a/python-pillow.spec b/python-pillow.spec
index 564e820..5b82d78 100644
--- a/python-pillow.spec
+++ b/python-pillow.spec
@@ -18,7 +18,7 @@
Name: python-%{srcname}
Version: 11.3.0
-Release: 8%{?dist}
+Release: 9%{?dist}
Summary: Python image processing library
# License: see http://www.pythonware.com/products/pil/license.htm
@@ -32,6 +32,12 @@ Patch0: pillow_mingw.patch
Patch1: https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
# Backport fix for CVE-2026-40192
Patch2: https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
+# Backport fix for CVE-2026-55380
+Patch3: https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
+# Backport fix for CVE-2026-54060, CVE-2026-54059, CVE-2026-55379
+Patch4: https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
+# Backport fix for CVE-2026-55798
+Patch5: https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
BuildRequires: freetype-devel
BuildRequires: gcc
@@ -310,6 +316,10 @@ popd
%changelog
+* Tue Jul 07 2026 Sandro Mani <manisandro@gmail.com> - 11.3.0-9
+- Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059,
+ CVE-2026-55379, CVE-2026-55798
+
* Sat Apr 18 2026 Sandro Mani <manisandro@gmail.com> - 11.3.0-8
- Backport fix for CVE-2026-40192
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-08 7:21 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-08 7:21 [rpms/python-pillow] f43: Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798 Sandro Mani
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox