public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/python-pillow] f43: Backport fixes for CVE-2026-59197 and CVE-2026-54058
@ 2026-07-19 7:03 Sandro Mani
0 siblings, 0 replies; only message in thread
From: Sandro Mani @ 2026-07-19 7:03 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/python-pillow
Branch : f43
Commit : 0e34cf3307cdc0a1aebf173c09227681a7289139
Author : Sandro Mani <manisandro@gmail.com>
Date : 2026-07-19T09:02:58+02:00
Stats : +218/-17 in 10 file(s)
URL : https://src.fedoraproject.org/rpms/python-pillow/c/0e34cf3307cdc0a1aebf173c09227681a7289139?branch=f43
Log:
Backport fixes for CVE-2026-59197 and CVE-2026-54058
---
diff --git a/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch b/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
index b698e37..9ad3d92 100644
--- a/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
+++ b/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/BdfFontFile.py Pillow-11.3.0-new/src/PIL/BdfFontFile.py
--- Pillow-11.3.0/src/PIL/BdfFontFile.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/BdfFontFile.py 2026-07-08 00:44:43.678121242 +0200
++++ Pillow-11.3.0-new/src/PIL/BdfFontFile.py 2026-07-19 08:50:48.485746648 +0200
@@ -69,6 +69,7 @@ def bdf_char(
# and x and y displacement (BBxoff0, BByoff0)
# of the lower left corner from the origin of the character.
@@ -11,7 +11,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/PIL/BdfFontFile.py Pillow-11.3.0-n
# followed by the width in x and y of the character in device pixels.
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/FontFile.py Pillow-11.3.0-new/src/PIL/FontFile.py
--- Pillow-11.3.0/src/PIL/FontFile.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/FontFile.py 2026-07-08 00:44:43.678503853 +0200
++++ Pillow-11.3.0-new/src/PIL/FontFile.py 2026-07-19 08:50:48.486101567 +0200
@@ -74,7 +74,7 @@ class FontFile:
if glyph:
d, dst, src, im = glyph
@@ -31,7 +31,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/PIL/FontFile.py Pillow-11.3.0-new/
tuple[tuple[int, int], tuple[int, int, int, int], tuple[int, int, int, int]]
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/PcfFontFile.py Pillow-11.3.0-new/src/PIL/PcfFontFile.py
--- Pillow-11.3.0/src/PIL/PcfFontFile.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/PcfFontFile.py 2026-07-08 00:44:43.678781879 +0200
++++ Pillow-11.3.0-new/src/PIL/PcfFontFile.py 2026-07-19 08:50:48.486342490 +0200
@@ -166,6 +166,7 @@ class PcfFontFile(FontFile.FontFile):
descent = i8(fp.read(1)) - 128
xsize = right - left
@@ -50,7 +50,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/PIL/PcfFontFile.py Pillow-11.3.0-n
return metrics
diff -rupN --no-dereference Pillow-11.3.0/Tests/test_font_bdf.py Pillow-11.3.0-new/Tests/test_font_bdf.py
--- Pillow-11.3.0/Tests/test_font_bdf.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/Tests/test_font_bdf.py 2026-07-08 00:44:43.679072737 +0200
++++ Pillow-11.3.0-new/Tests/test_font_bdf.py 2026-07-19 08:50:48.486608727 +0200
@@ -4,7 +4,7 @@ import io
import pytest
@@ -77,7 +77,7 @@ diff -rupN --no-dereference Pillow-11.3.0/Tests/test_font_bdf.py Pillow-11.3.0-n
with pytest.raises(SyntaxError):
diff -rupN --no-dereference Pillow-11.3.0/Tests/test_fontfile.py Pillow-11.3.0-new/Tests/test_fontfile.py
--- Pillow-11.3.0/Tests/test_fontfile.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/Tests/test_fontfile.py 2026-07-08 00:44:43.679324566 +0200
++++ Pillow-11.3.0-new/Tests/test_fontfile.py 2026-07-19 08:50:48.486848155 +0200
@@ -20,6 +20,13 @@ def test_compile() -> None:
assert font.ysize == 2
@@ -94,7 +94,7 @@ diff -rupN --no-dereference Pillow-11.3.0/Tests/test_fontfile.py Pillow-11.3.0-n
diff -rupN --no-dereference Pillow-11.3.0/Tests/test_font_pcf.py Pillow-11.3.0-new/Tests/test_font_pcf.py
--- Pillow-11.3.0/Tests/test_font_pcf.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/Tests/test_font_pcf.py 2026-07-08 00:44:43.679576479 +0200
++++ Pillow-11.3.0-new/Tests/test_font_pcf.py 2026-07-19 08:50:48.487107752 +0200
@@ -1,12 +1,13 @@
from __future__ import annotations
diff --git a/3cb854e8b2bab43f40e342e665f9340d861aa628.patch b/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
index 8305006..96211e4 100644
--- a/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
+++ b/3cb854e8b2bab43f40e342e665f9340d861aa628.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/FitsImagePlugin.py Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py
--- Pillow-11.3.0/src/PIL/FitsImagePlugin.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py 2026-07-08 00:44:43.401615913 +0200
++++ Pillow-11.3.0-new/src/PIL/FitsImagePlugin.py 2026-07-19 08:50:48.237448703 +0200
@@ -128,17 +128,18 @@ class FitsGzipDecoder(ImageFile.PyDecode
def decode(self, buffer: bytes | Image.SupportsArrayInterface) -> tuple[int, int]:
diff --git a/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d.patch b/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d.patch
new file mode 100644
index 0000000..a37aad0
--- /dev/null
+++ b/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d.patch
@@ -0,0 +1,69 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/map.c Pillow-11.3.0-new/src/map.c
+--- Pillow-11.3.0/src/map.c 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/map.c 2026-07-19 08:50:49.003192816 +0200
+@@ -82,14 +82,16 @@ PyImaging_MapBuffer(PyObject *self, PyOb
+ return NULL;
+ }
+
+- if (stride <= 0) {
+- if (!strcmp(mode, "L") || !strcmp(mode, "P")) {
+- stride = xsize;
+- } else if (!strncmp(mode, "I;16", 4)) {
+- stride = xsize * 2;
+- } else {
+- stride = xsize * 4;
+- }
++ int pixelsize;
++ if (!strcmp(mode, "L") || !strcmp(mode, "P")) {
++ pixelsize = 1;
++ } else if (!strncmp(mode, "I;16", 4)) {
++ pixelsize = 2;
++ } else {
++ pixelsize = 4;
++ }
++ if (stride <= xsize * pixelsize) {
++ stride = xsize * pixelsize;
+ }
+
+ if (stride > 0 && ysize > PY_SSIZE_T_MAX / stride) {
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_file_mcidas.py Pillow-11.3.0-new/Tests/test_file_mcidas.py
+--- Pillow-11.3.0/Tests/test_file_mcidas.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_file_mcidas.py 2026-07-19 08:50:49.004275380 +0200
+@@ -1,5 +1,8 @@
+ from __future__ import annotations
+
++import struct
++from pathlib import Path
++
+ import pytest
+
+ from PIL import Image, McIdasImagePlugin
+@@ -14,6 +17,28 @@ def test_invalid_file() -> None:
+ McIdasImagePlugin.McIdasImageFile(invalid_file)
+
+
++def test_undersized_stride(tmp_path: Path) -> None:
++ # A crafted area descriptor declares a row stride far smaller than a full
++ # row of pixels. Memory mapping must not lay out row pointers at that
++ # stride, which would read past the mapped buffer; the image is rejected
++ # instead of leaking memory or crashing.
++ words = [0] * 65
++ words[2] = 4 # magic: 00 00 00 00 00 00 00 04
++ words[9] = 1 # ysize
++ words[10] = 200000 # xsize -> a full row is 200000 bytes (mode "L")
++ words[11] = 1 # mode "L"
++ words[14] = 0 # zeroes the xsize term of the stride
++ words[15] = 1 # stride = 1 (much smaller than a row)
++ data = struct.pack("!64i", *words[1:65])
++
++ path = tmp_path / "undersized_stride.area"
++ path.write_bytes(data)
++
++ with Image.open(path) as im:
++ with pytest.raises(ValueError, match="buffer is not large enough"):
++ im.load()
++
++
+ def test_valid_file() -> None:
+ # Arrange
+ # https://ghrc.nsstc.nasa.gov/hydro/details/cmx3g8
diff --git a/853ece9ed20c5d80ffa22dce8698869a9da8bbfc.patch b/853ece9ed20c5d80ffa22dce8698869a9da8bbfc.patch
new file mode 100644
index 0000000..6296b3c
--- /dev/null
+++ b/853ece9ed20c5d80ffa22dce8698869a9da8bbfc.patch
@@ -0,0 +1,78 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/ImageFilter.py Pillow-11.3.0-new/src/PIL/ImageFilter.py
+--- Pillow-11.3.0/src/PIL/ImageFilter.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/PIL/ImageFilter.py 2026-07-19 08:50:48.761730315 +0200
+@@ -96,6 +96,12 @@ class RankFilter(Filter):
+ name = "Rank"
+
+ def __init__(self, size: int, rank: int) -> None:
++ if size % 2 == 0:
++ msg = "bad filter size"
++ raise ValueError(msg)
++ if rank < 0 or rank >= size * size:
++ msg = "bad rank value"
++ raise ValueError(msg)
+ self.size = size
+ self.rank = rank
+
+@@ -118,8 +124,8 @@ class MedianFilter(RankFilter):
+ name = "Median"
+
+ def __init__(self, size: int = 3) -> None:
+- self.size = size
+- self.rank = size * size // 2
++ rank = size * size // 2
++ super().__init__(size, rank)
+
+
+ class MinFilter(RankFilter):
+@@ -133,8 +139,8 @@ class MinFilter(RankFilter):
+ name = "Min"
+
+ def __init__(self, size: int = 3) -> None:
+- self.size = size
+- self.rank = 0
++ rank = 0
++ super().__init__(size, rank)
+
+
+ class MaxFilter(RankFilter):
+@@ -148,8 +154,8 @@ class MaxFilter(RankFilter):
+ name = "Max"
+
+ def __init__(self, size: int = 3) -> None:
+- self.size = size
+- self.rank = size * size - 1
++ rank = size * size - 1
++ super().__init__(size, rank)
+
+
+ class ModeFilter(Filter):
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_image_filter.py Pillow-11.3.0-new/Tests/test_image_filter.py
+--- Pillow-11.3.0/Tests/test_image_filter.py 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/Tests/test_image_filter.py 2026-07-19 08:50:48.762092309 +0200
+@@ -136,11 +136,23 @@ def test_rankfilter_error(filter: ImageF
+
+
+ def test_rankfilter_properties() -> None:
+- rankfilter = ImageFilter.RankFilter(1, 2)
++ rankfilter = ImageFilter.RankFilter(3, 2)
+
+- assert rankfilter.size == 1
++ assert rankfilter.size == 3
+ assert rankfilter.rank == 2
+
++ with pytest.raises(ValueError, match="bad filter size"):
++ ImageFilter.RankFilter(2, 1)
++ with pytest.raises(ValueError, match="bad filter size"):
++ ImageFilter.MaxFilter(2)
++ with pytest.raises(ValueError, match="bad filter size"):
++ ImageFilter.MedianFilter(2)
++ with pytest.raises(ValueError, match="bad filter size"):
++ ImageFilter.MinFilter(2)
++
++ with pytest.raises(ValueError, match="bad rank value"):
++ ImageFilter.RankFilter(1, 1)
++
+
+ def test_builtinfilter_p() -> None:
+ builtin_filter = ImageFilter.BuiltinFilter()
diff --git a/88194166691b7b603529b8b036ab3ab9cedd2de4.patch b/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
index 7983057..d130bb1 100644
--- a/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
+++ b/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/ImageShow.py Pillow-11.3.0-new/src/PIL/ImageShow.py
--- Pillow-11.3.0/src/PIL/ImageShow.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/ImageShow.py 2026-07-08 00:44:43.819636918 +0200
++++ Pillow-11.3.0-new/src/PIL/ImageShow.py 2026-07-19 08:50:48.642211901 +0200
@@ -131,6 +131,7 @@ class WindowsViewer(Viewer):
options = {"compress_level": 1, "save_all": True}
@@ -11,7 +11,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/PIL/ImageShow.py Pillow-11.3.0-new
"&& ping -n 4 127.0.0.1 >NUL "
diff -rupN --no-dereference Pillow-11.3.0/Tests/test_imageshow.py Pillow-11.3.0-new/Tests/test_imageshow.py
--- Pillow-11.3.0/Tests/test_imageshow.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/Tests/test_imageshow.py 2026-07-08 00:44:43.820045572 +0200
++++ Pillow-11.3.0-new/Tests/test_imageshow.py 2026-07-19 08:50:48.642571321 +0200
@@ -107,6 +107,9 @@ def test_viewers(viewer: ImageShow.Viewe
except NotImplementedError:
pass
diff --git a/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch b/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
index 3138bdf..ed9fe68 100644
--- a/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
+++ b/9000313cc5d4a31bdcdd6d7f0781101abab553aa.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/decode.c Pillow-11.3.0-new/src/decode.c
--- Pillow-11.3.0/src/decode.c 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/decode.c 2026-07-08 00:44:43.254138224 +0200
++++ Pillow-11.3.0-new/src/decode.c 2026-07-19 08:50:48.110511586 +0200
@@ -186,7 +186,8 @@ _setimage(ImagingDecoderObject *decoder,
state->ysize = y1 - y0;
}
@@ -13,7 +13,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/decode.c Pillow-11.3.0-new/src/dec
return NULL;
diff -rupN --no-dereference Pillow-11.3.0/src/encode.c Pillow-11.3.0-new/src/encode.c
--- Pillow-11.3.0/src/encode.c 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/encode.c 2026-07-08 00:44:43.254804101 +0200
++++ Pillow-11.3.0-new/src/encode.c 2026-07-19 08:50:48.110954189 +0200
@@ -254,7 +254,8 @@ _setimage(ImagingEncoderObject *encoder,
state->ysize = y1 - y0;
}
diff --git a/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1.patch b/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1.patch
new file mode 100644
index 0000000..4899d5a
--- /dev/null
+++ b/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1.patch
@@ -0,0 +1,45 @@
+diff -rupN --no-dereference Pillow-11.3.0/src/libImaging/Filter.c Pillow-11.3.0-new/src/libImaging/Filter.c
+--- Pillow-11.3.0/src/libImaging/Filter.c 2025-07-01 09:41:24.000000000 +0200
++++ Pillow-11.3.0-new/src/libImaging/Filter.c 2026-07-19 08:50:48.880125080 +0200
+@@ -59,6 +59,12 @@ ImagingExpand(Imaging imIn, int xmargin,
+ if (xmargin < 0 && ymargin < 0) {
+ return (Imaging)ImagingError_ValueError("bad kernel size");
+ }
++ if (xmargin > INT_MAX / (xmargin * (int)sizeof(FLOAT32))) {
++ return (Imaging)ImagingError_ValueError("filter size too large");
++ }
++ if (ymargin > INT_MAX / (ymargin * (int)sizeof(FLOAT32))) {
++ return (Imaging)ImagingError_ValueError("filter size too large");
++ }
+
+ imOut = ImagingNewDirty(
+ imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin
+diff -rupN --no-dereference Pillow-11.3.0/src/PIL/ImageFilter.py Pillow-11.3.0-new/src/PIL/ImageFilter.py
+--- Pillow-11.3.0/src/PIL/ImageFilter.py 2026-07-19 08:50:48.874193964 +0200
++++ Pillow-11.3.0-new/src/PIL/ImageFilter.py 2026-07-19 08:50:48.879504441 +0200
+@@ -99,6 +99,9 @@ class RankFilter(Filter):
+ if size % 2 == 0:
+ msg = "bad filter size"
+ raise ValueError(msg)
++ if size * size * 4 > (2**31 - 1):
++ msg = "filter size too large"
++ raise ValueError(msg)
+ if rank < 0 or rank >= size * size:
+ msg = "bad rank value"
+ raise ValueError(msg)
+diff -rupN --no-dereference Pillow-11.3.0/Tests/test_image_filter.py Pillow-11.3.0-new/Tests/test_image_filter.py
+--- Pillow-11.3.0/Tests/test_image_filter.py 2026-07-19 08:50:48.875524163 +0200
++++ Pillow-11.3.0-new/Tests/test_image_filter.py 2026-07-19 08:50:48.879776512 +0200
+@@ -150,6 +150,12 @@ def test_rankfilter_properties() -> None
+ with pytest.raises(ValueError, match="bad filter size"):
+ ImageFilter.MinFilter(2)
+
++ with pytest.raises(ValueError, match="filter size too large"):
++ ImageFilter.RankFilter(23171, 1)
++ im = Image.new("1", (1, 1))
++ with pytest.raises(ValueError, match="filter size too large"):
++ im.im.expand(23171)
++
+ with pytest.raises(ValueError, match="bad rank value"):
+ ImageFilter.RankFilter(1, 1)
+
diff --git a/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch b/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
index b4921e4..e0e1693 100644
--- a/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
+++ b/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/src/PIL/GdImageFile.py Pillow-11.3.0-new/src/PIL/GdImageFile.py
--- Pillow-11.3.0/src/PIL/GdImageFile.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/PIL/GdImageFile.py 2026-07-08 00:44:43.541134873 +0200
++++ Pillow-11.3.0-new/src/PIL/GdImageFile.py 2026-07-19 08:50:48.364244777 +0200
@@ -29,7 +29,7 @@ from __future__ import annotations
from typing import IO
@@ -20,7 +20,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/PIL/GdImageFile.py Pillow-11.3.0-n
true_color_offset = 2 if true_color else 0
diff -rupN --no-dereference Pillow-11.3.0/Tests/test_file_gd.py Pillow-11.3.0-new/Tests/test_file_gd.py
--- Pillow-11.3.0/Tests/test_file_gd.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/Tests/test_file_gd.py 2026-07-08 00:44:43.541726407 +0200
++++ Pillow-11.3.0-new/Tests/test_file_gd.py 2026-07-19 08:50:48.364543894 +0200
@@ -2,7 +2,7 @@ from __future__ import annotations
import pytest
diff --git a/pillow_mingw.patch b/pillow_mingw.patch
index 6e67d7d..0fd12bc 100644
--- a/pillow_mingw.patch
+++ b/pillow_mingw.patch
@@ -1,6 +1,6 @@
diff -rupN --no-dereference Pillow-11.3.0/setup.py Pillow-11.3.0-new/setup.py
--- Pillow-11.3.0/setup.py 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/setup.py 2026-07-08 00:44:43.116613779 +0200
++++ Pillow-11.3.0-new/setup.py 2026-07-19 08:50:47.973345255 +0200
@@ -144,7 +144,7 @@ class RequiredDependencyException(Except
pass
@@ -66,7 +66,7 @@ diff -rupN --no-dereference Pillow-11.3.0/setup.py Pillow-11.3.0-new/setup.py
build_ext.build_extensions(self)
diff -rupN --no-dereference Pillow-11.3.0/src/libImaging/ImPlatform.h Pillow-11.3.0-new/src/libImaging/ImPlatform.h
--- Pillow-11.3.0/src/libImaging/ImPlatform.h 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/libImaging/ImPlatform.h 2026-07-08 00:44:43.117079889 +0200
++++ Pillow-11.3.0-new/src/libImaging/ImPlatform.h 2026-07-19 08:50:47.973855846 +0200
@@ -29,7 +29,7 @@
#if defined(_WIN32) || defined(__CYGWIN__) /* WIN */
@@ -78,7 +78,7 @@ diff -rupN --no-dereference Pillow-11.3.0/src/libImaging/ImPlatform.h Pillow-11.
#undef _WIN64
diff -rupN --no-dereference Pillow-11.3.0/src/Tk/tkImaging.c Pillow-11.3.0-new/src/Tk/tkImaging.c
--- Pillow-11.3.0/src/Tk/tkImaging.c 2025-07-01 09:41:24.000000000 +0200
-+++ Pillow-11.3.0-new/src/Tk/tkImaging.c 2026-07-08 00:44:43.117386822 +0200
++++ Pillow-11.3.0-new/src/Tk/tkImaging.c 2026-07-19 08:50:47.974163609 +0200
@@ -321,7 +321,7 @@ load_tkinter_funcs(void) {
/* Allocate module handlers array */
diff --git a/python-pillow.spec b/python-pillow.spec
index 5b82d78..a7628b2 100644
--- a/python-pillow.spec
+++ b/python-pillow.spec
@@ -18,7 +18,7 @@
Name: python-%{srcname}
Version: 11.3.0
-Release: 9%{?dist}
+Release: 10%{?dist}
Summary: Python image processing library
# License: see http://www.pythonware.com/products/pil/license.htm
@@ -38,6 +38,12 @@ Patch3: https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c
Patch4: https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d.patch
# Backport fix for CVE-2026-55798
Patch5: https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4.patch
+# Dependent patch for applying fix for CVE-2026-59197
+Patch6: https://github.com/python-pillow/Pillow/commit/853ece9ed20c5d80ffa22dce8698869a9da8bbfc.patch
+# Backport fix for CVE-2026-59197
+Patch7: https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1.patch
+# Backport fix for CVE-2026-54058
+Patch8: https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d.patch
BuildRequires: freetype-devel
BuildRequires: gcc
@@ -316,6 +322,9 @@ popd
%changelog
+* Sun Jul 19 2026 Sandro Mani <manisandro@gmail.com> - 11.3.0-10
+- Backport fixes for CVE-2026-59197 and CVE-2026-54058
+
* Tue Jul 07 2026 Sandro Mani <manisandro@gmail.com> - 11.3.0-9
- Backport fixes for CVE-2026-55380, CVE-2026-54060, CVE-2026-54059,
CVE-2026-55379, CVE-2026-55798
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-19 7:03 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-19 7:03 [rpms/python-pillow] f43: Backport fixes for CVE-2026-59197 and CVE-2026-54058 Sandro Mani
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox