From patchwork Fri Oct 16 06:23:15 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101021 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38741CCF2C2 for ; Fri, 16 Oct 2026 06:23:36 +0000 (UTC) Received: from rcdn-iport-2.cisco.com (rcdn-iport-2.cisco.com [173.37.86.73]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15947.1792131805799741436 for ; Thu, 15 Oct 2026 23:23:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=Qy9gTU4i; spf=pass (domain: cisco.com, ip: 173.37.86.73, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=7543; q=dns/txt; s=iport01; t=1792131805; x=1793341405; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=2onkLKYj8Y7rtqJDbgZkAVcpSzOfPNiE41LKJ3S0TuY=; b=Qy9gTU4i26IfTmv+sXn//Sq2seh+0Qy4BWGIbGHfbp36LcXKz0asLMdV GmfUT4lZRA4RqK5FAKt0MHe3vGL5vwc4PUYyUDRQYm9Sxmt9n/tfvsYGR 90saUOAsBjNP3QCw9BJkmXYeoABw3+rDY8FjAdNx88Bep50a3v+AV+pNf od1RMpe2V46ndiZ80cdOj4SXRy/YDFjTGKxpWc5pF3RDGH68Xsv34oLyu 2uN8b9mWIyy6KvUhQgCU5fkiVChdKdMAxLQbU35Xh8pY3qE2YwPoIBO1v kI8hGnFNBUSDF+L2sn9w8l9pxDS3yaArSb43prglp+UWfEL+408Be2Amu A==; X-CSE-ConnectionGUID: 85hAigUXReqSZ4Jypj0i0w== X-CSE-MsgGUID: tkkI2TUqSj2qtSG86tBIYA== X-IPAS-Result: A0BLAgBRwtFq/43/Ja1aHgEBCxIMggULgld1YENJhFePUoIhA54cgX4PAQEBD0QNBAEBhD9GAo4VAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZASAQIBAyMECwEYAT0cAwECAwImAgIrIwgZgwIBgnQDEbx0en8zgQGDKQE/AkPaGoFoAQsUAYEKLoVAgx8BhQNdGAGEfCcbgUlEglCCLoEFgVwBAYU7gmoEgg2BDxKBWoEDhAuQOUiBAhwDWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XL1gbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD0BbgeSFB6CZQGBDQErBXoGDIEqAg2TGpI9oQ+EKIwilToaM4QEgVeSQJJUC5h9izeCU5U8Q1CEaYFoPIFHCwczGggbFTuCZwlKGQ+OKw4LHINEgX+DZch2JzICCTIBAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:jI62ta9IY/BquPzjquskDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3m zZMDzuGMq2DMzTxLdoia4u2pk0BvMSAnIVkQAM5rnxEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2lmYI0x++lKMVtD7 McqdBIcdhLbhrqplefTpulE3qzPLeHxN48Z/3UlxjbDALN+HdbIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0Qn1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW3aoKMKoDaFK25mG6Ep WHnpVjEGyoYbsWD8hXVrG6Gp97myHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBWi4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:5vCIyK16jIid87VZp69GogqjBJAkLtp133Aq2lEZdPUzSL3+qy nOpoV+6faaslgssR0b9OxofZPwIk80lqQFhLX5Q43CYOCOggLBR+tfBMnZsl/d8kbFmdK1u5 0NT0EHMr3NJGk/q9rm6w+lFNtl6tyG/Ke0wdr69R5WPGdXg2UK1XYANu5deXcGPTV7OQ== X-Talos-CUID: 9a23:WypeBWl7v0+oYdISFVYdbNxQtwLXOS2AzF7RLHKIM2twc4/Ja06I+vtly9U7zg== X-Talos-MUID: 9a23:EuAQAQQs1wFQNUjsRXTwhzJDbvtV+p+sUlkRqrpW5dWuFB1ZbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="522018489" Received: from rcdn-l-core-04.cisco.com ([173.37.255.141]) by rcdn-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:24 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-04.cisco.com (Postfix) with ESMTPS id C0572180004AE for ; Fri, 16 Oct 2026 06:23:24 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 66C0BCBF201; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 1/9] python3-pillow: Fix CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 Date: Thu, 15 Oct 2026 23:23:15 -0700 Message-Id: <20261016062323.251925-2-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-04.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131058 This patch applies the upstream fix as referenced in [2], [3] and [4], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d [2] https://nvd.nist.gov/vuln/detail/cve-2026-54059 [3] https://nvd.nist.gov/vuln/detail/CVE-2026-54060 [4] https://nvd.nist.gov/vuln/detail/cve-2026-55379 Signed-off-by: Yogita Urade --- ...-54059_CVE-2026-54060_CVE-2026-55379.patch | 168 ++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 169 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch new file mode 100644 index 0000000000..72a83a178e --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch @@ -0,0 +1,168 @@ +From 7d525ae2ccf9109079f6f640ad88c8cb117853d9 Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Tue, 23 Jun 2026 11:41:22 +1000 +Subject: [PATCH] Add decompression bomb checks to FontFile classes (#9711) + +CVE: CVE-2026-54059 CVE-2026-54060 CVE-2026-55379 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d] + +Backport Changes: +- Wrynose 12.2.0 handles standard and jumbo PCF metrics in separate loops, + so the decompression-bomb check is added at both call sites in + src/PIL/PcfFontFile.py file, upstream’s shared append helper needs only + one check. + +(cherry picked from commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d) +Signed-off-by: Yogita Urade +--- + Tests/test_font_bdf.py | 10 +++++++++- + Tests/test_font_pcf.py | 21 ++++++++++++++++++++- + Tests/test_fontfile.py | 7 +++++++ + src/PIL/BdfFontFile.py | 1 + + src/PIL/FontFile.py | 3 ++- + src/PIL/PcfFontFile.py | 2 ++ + 6 files changed, 41 insertions(+), 3 deletions(-) +diff --git a/Tests/test_font_pcf.py b/Tests/test_font_pcf.py +index 321dd8560..d5b080add 100644 +--- a/Tests/test_font_pcf.py ++++ b/Tests/test_font_pcf.py +@@ -1,12 +1,13 @@ + from __future__ import annotations + + import os ++from io import BytesIO + from pathlib import Path + from typing import AnyStr + + import pytest + +-from PIL import FontFile, Image, ImageDraw, ImageFont, PcfFontFile ++from PIL import FontFile, Image, ImageDraw, ImageFont, PcfFontFile, _binary + + from .helper import ( + assert_image_equal_tofile, +@@ -117,3 +118,21 @@ def test_high_characters(request: pytest.FixtureRequest, tmp_path: Path) -> None + _test_high_characters(request, tmp_path, message) + # accept bytes instances. + _test_high_characters(request, tmp_path, message.encode("latin1")) ++ ++ ++def test_decompression_bomb() -> None: ++ with open(fontname, "rb") as fp: ++ data = fp.read() ++ b = BytesIO( ++ data[:900] ++ + _binary.o32le(0) # jumbo format ++ + _binary.o32le(1) # number of metrics ++ + _binary.o16le(0) # left ++ + _binary.o16le(65535) # right ++ + _binary.o16le(0) # width ++ + _binary.o16le(0) # ascent ++ + _binary.o16le(65535) # descent ++ + _binary.o16le(0) # attributes ++ ) ++ with pytest.raises(Image.DecompressionBombError): ++ PcfFontFile.PcfFontFile(b) +diff --git a/src/PIL/PcfFontFile.py b/src/PIL/PcfFontFile.py +index b923293b0..52947ff04 100644 +--- a/src/PIL/PcfFontFile.py ++++ b/src/PIL/PcfFontFile.py +@@ -170,6 +170,7 @@ class PcfFontFile(FontFile.FontFile): + descent = i8(fp.read(1)) - 128 + xsize = right - left + ysize = ascent + descent ++ Image._decompression_bomb_check((xsize, ysize)) + append((xsize, ysize, left, right, width, ascent, descent, 0)) + + else: +@@ -183,6 +184,7 @@ class PcfFontFile(FontFile.FontFile): + attributes = i16(fp.read(2)) + xsize = right - left + ysize = ascent + descent ++ Image._decompression_bomb_check((xsize, ysize)) + append((xsize, ysize, left, right, width, ascent, descent, attributes)) + + return metrics + +diff --git a/Tests/test_font_bdf.py b/Tests/test_font_bdf.py +index b4155c8793b..033b5f8fbd5 100644 +--- a/Tests/test_font_bdf.py ++++ b/Tests/test_font_bdf.py +@@ -4,7 +4,7 @@ + + import pytest + +-from PIL import BdfFontFile, FontFile ++from PIL import BdfFontFile, FontFile, Image + + filename = "Tests/images/courB08.bdf" + +@@ -24,6 +24,14 @@ def test_zero_width_chars() -> None: + BdfFontFile.BdfFontFile(io.BytesIO(data)) + + ++def test_decompression_bomb() -> None: ++ with open(filename, "rb") as fp: ++ data = fp.read() ++ b = io.BytesIO(data.replace(b"BBX 1 1", b"BBX 13378 13378")) ++ with pytest.raises(Image.DecompressionBombError): ++ BdfFontFile.BdfFontFile(b) ++ ++ + def test_invalid_file() -> None: + with open("Tests/images/flower.jpg", "rb") as fp: + with pytest.raises(SyntaxError): + +diff --git a/Tests/test_fontfile.py b/Tests/test_fontfile.py +index 1a9069fd892..bf857e230b8 100644 +--- a/Tests/test_fontfile.py ++++ b/Tests/test_fontfile.py +@@ -30,6 +30,13 @@ def test_compile() -> None: + assert font.ysize == 2 + + ++def test_decompression_bomb() -> None: ++ font = FontFile.FontFile() ++ font.glyph[0] = ((0, 0), (0, 0, 0, 0), (0, 0, 10000, 10000), Image.new("L", (0, 0))) ++ with pytest.raises(Image.DecompressionBombError): ++ font.compile() ++ ++ + def test_save(tmp_path: Path) -> None: + tempname = str(tmp_path / "temp.pil") + + +diff --git a/src/PIL/BdfFontFile.py b/src/PIL/BdfFontFile.py +index 1c8c28ff038..098779bfd6e 100644 +--- a/src/PIL/BdfFontFile.py ++++ b/src/PIL/BdfFontFile.py +@@ -70,6 +70,7 @@ def bdf_char( + # and x and y displacement (BBxoff0, BByoff0) + # of the lower left corner from the origin of the character. + width, height, x_disp, y_disp = (int(p) for p in props["BBX"].split()) ++ Image._decompression_bomb_check((width, height)) + + # The word DWIDTH + # followed by the width in x and y of the character in device pixels. + +diff --git a/src/PIL/FontFile.py b/src/PIL/FontFile.py +index 341431d3f45..c3be4ae3ddd 100644 +--- a/src/PIL/FontFile.py ++++ b/src/PIL/FontFile.py +@@ -74,7 +74,7 @@ def compile(self) -> None: + if glyph: + d, dst, src, im = glyph + h = max(h, src[3] - src[1]) +- w = w + (src[2] - src[0]) ++ w += src[2] - src[0] + if w > WIDTH: + lines += 1 + w = src[2] - src[0] +@@ -89,6 +89,7 @@ def compile(self) -> None: + self.ysize = h + + # paste glyphs into bitmap ++ Image._decompression_bomb_check((xsize, ysize)) + self.bitmap = Image.new("1", (xsize, ysize)) + self.metrics: list[ + tuple[tuple[int, int], tuple[int, int, int, int], tuple[int, int, int, int]] diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index d5c65fbd11..aa7de55fab 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -9,6 +9,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://0001-support-cross-compiling.patch \ file://CVE-2026-54058.patch \ file://CVE-2026-59204.patch \ + file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:16 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101019 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14406CCF2C1 for ; Fri, 16 Oct 2026 06:23:36 +0000 (UTC) Received: from rcdn-iport-8.cisco.com (rcdn-iport-8.cisco.com [173.37.86.79]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15946.1792131805683302743 for ; Thu, 15 Oct 2026 23:23:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=HkCOlyYR; spf=pass (domain: cisco.com, ip: 173.37.86.79, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3719; q=dns/txt; s=iport01; t=1792131805; x=1793341405; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=MVY245eX5PHySUoSMW/Av7lc5uNZL2G4GQNwHSaz0bg=; b=HkCOlyYRlVqPBHKsOTw9GHlm3/PVDpYHayJPLAfTGJJ0z8PLdSXukiFI vj1OfRmShtAFac7mYg8JdDwmWYK8MEKjolWsOCsbv7ls7eQTvF+c6eMTN 6y3SAOdOF+suoVFWu7MYl0gZfDvQ9gbdGQBp8xAbO0aSCZnPGPHfBsfvy EbhOFIye6+7sfp6xAqM6qLteRmtszeK0TxY21n7xXBdszVCDJWVfa4bIO y71YniZZF/rORNH3b56gJi0eATwNkGcQi7OMTPHTCQ7YOMChxjdynccNf Q9KUHhgX1kpYnodtGyqnrKDV43gX3zsXbiZNFz3RcckoPy8FVCofaFEzv A==; X-CSE-ConnectionGUID: qfqqYxyURsymY4ObJPEF1Q== X-CSE-MsgGUID: MbF3/rWIQ3ObfKwG3l+TmQ== X-IPAS-Result: A0BJAgBfwdFq/4v/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHOBeTOBAYMpAYFU2UqBaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWBO4IugQWBXAKIJQSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZQGBDQErBXoSgRsepVehD4QojCKVOhozhVulFAuYfYs3glOVPIEThGmBaDyBWTMaCBsVgyIJShkPjjmDa4VkyHYnMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:9BIMnqoWFDHJtUtuH03ET5iIzKNeBmJOZBIvgKrLsJaIsI4StFCzt garIBmFOarbN2ugfNAnPN7k/RhQup7RztVlHQJk+y8zRHhDouPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0v95GHh/5 e0lEiscayHfoOiU+J+VE9A506zPLOGzVG8ekmtrwTecCbMtRorOBv2Qo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5MWfrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4baHZoOzhfEz o7A10HzLEpdLuO+8GGi+HyPmcCUmWDHXbtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2YbLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWra1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:seD7lKD4f9j4b07lHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:siLyK2syAoOI6miyTzoB7BJy6Is8fGTE/WfBHnWjGGNYFJqfa2e91vpdxp8= X-Talos-MUID: 9a23:w+ajiwRrTj6/DyB4RXTJjh85c91Xwp31L0oDsoop4M3HCSlJbmI= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="528073894" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-8.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:24 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id C61281800022B for ; Fri, 16 Oct 2026 06:23:24 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 6C31ECBF202; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 2/9] python3-pillow: Fix CVE-2026-55380 Date: Thu, 15 Oct 2026 23:23:16 -0700 Message-Id: <20261016062323.251925-3-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131056 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-55380.patch | 62 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 63 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch new file mode 100644 index 0000000000..16321294c9 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-55380.patch @@ -0,0 +1,62 @@ +From 176781ac99ebf9aa5486384e6e2e4896b30d95b5 Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Sun, 21 Jun 2026 14:06:24 +1000 +Subject: [PATCH] Add decompression bomb check to GdImageFile (#9693) + +CVE: CVE-2026-55380 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675] + +(cherry picked from commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675) +Signed-off-by: Yogita Urade +--- + Tests/test_file_gd.py | 8 +++++++- + src/PIL/GdImageFile.py | 3 ++- + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/Tests/test_file_gd.py b/Tests/test_file_gd.py +index 8a49fd4fa..7d9e85976 100644 +--- a/Tests/test_file_gd.py ++++ b/Tests/test_file_gd.py +@@ -4,7 +4,7 @@ from io import BytesIO + + import pytest + +-from PIL import GdImageFile, UnidentifiedImageError ++from PIL import GdImageFile, Image, UnidentifiedImageError, _binary + + from .helper import assert_image_similar_tofile + +@@ -31,6 +31,12 @@ def test_bad_mode() -> None: + GdImageFile.open(TEST_GD_FILE, "bad mode") + + ++def test_decompression_bomb() -> None: ++ b = BytesIO(_binary.o16be(65535) + _binary.o16be(50000) + _binary.o16be(50000)) ++ with pytest.raises(Image.DecompressionBombError): ++ GdImageFile.open(b) ++ ++ + def test_invalid_file() -> None: + invalid_file = "Tests/images/flower.jpg" + +diff --git a/src/PIL/GdImageFile.py b/src/PIL/GdImageFile.py +index d73bc1982..4ff96f1fa 100644 +--- a/src/PIL/GdImageFile.py ++++ b/src/PIL/GdImageFile.py +@@ -30,7 +30,7 @@ from __future__ import annotations + + from typing import IO + +-from . import ImageFile, ImagePalette, UnidentifiedImageError ++from . import Image, ImageFile, ImagePalette, UnidentifiedImageError + from ._binary import i16be as i16 + from ._binary import i32be as i32 + from ._typing import StrOrBytesPath +@@ -59,6 +59,7 @@ class GdImageFile(ImageFile.ImageFile): + + self._mode = "P" + self._size = i16(s, 2), i16(s, 4) ++ Image._decompression_bomb_check(self.size) + + true_color = s[6] + true_color_offset = 2 if true_color else 0 diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index aa7de55fab..d5576560e7 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -10,6 +10,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-54058.patch \ file://CVE-2026-59204.patch \ file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \ + file://CVE-2026-55380.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:17 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101020 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C19CCCF2C0 for ; Fri, 16 Oct 2026 06:23:36 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15654.1792131805734630105 for ; Thu, 15 Oct 2026 23:23:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=cZFoO8J2; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4219; q=dns/txt; s=iport01; t=1792131805; x=1793341405; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=+h08aWBADljYz9ETtWo20jmf9VXgOMofXo54SeThcd4=; b=cZFoO8J28JLwcc/kuqvxgBkyAlOVto7wi3AsWdMBjHxaob+Vpdgg8qDg LlSuAcfktgENdP6bqcY5QPUufreTioOAiWd8g+DF26tJBAIwYk7frNXyD LhizsQ8fpkivJ5nTeAul91Uy06dkmIvYxbjyIV+jZIIjiZ74wFASJb5le 4lWFlSAQtdAeBYEQR0nsl1UcvxkSd5w9yuG2c8SUfbJKF0oql78wj+pxi yctBOGLB7RvbaXxpb06dB/17J94iJm0Wh2lcMY0nElPHAOmE8slgDmB7W 4kHv69deRUc5ZOUPyETNvX9tXcfkOA6Q1Un0waofmUkp1x8jYziJfD6Dl A==; X-CSE-ConnectionGUID: NLu0DyUzRPWnhayGngfgjw== X-CSE-MsgGUID: GHx6uHFvR3esZxbh4HDJ8A== X-IPAS-Result: A0BJAgBfwdFq/4v/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHOBeTOBAYMpAT8BRFDZSoFoAQsUAYE4hUCII10YAYR8JxuBSUSBFYE7gi6BBYFcAoglBIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJlAX4PASsFeoEtHqM2giGhD4QojCKVOhozhVulFAuYfYs3glOWT4RpgWg8gVkzGggbFYMiCUoZD445g2uFZMh2JzICCQMvAQEHAgcOAwuBaJACLYFPAQE IronPort-Data: A9a23:kaHxva+Cau71r8253vKdDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3y jAZWGiBPP+PYWbyc9pzPImxoxhUusSBy4VnGQZkqiFEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kQGZBA1vdKE1t2y voYISEiaB+NiOCplefTpulE3qzPLeHxN48Z/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZOEwn1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2boaFJIPUFK25mG63h nKY4kTXHCtBOcet2TCFrlKApL/myHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:FkWXd6rT2PRlS8h4svWRZMQaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:3LQUrGw0DV9vrUZ8gKiFBgUyPt19Xmzg3k3oHEm4AHdGTrKbRl2PrfY= X-Talos-MUID: 9a23:j+BCaA+5b27WEZP00RQr5rqQf+hI8/qzKG4Tq84LoPuUPywsGxu/3B3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536486769" Received: from rcdn-l-core-02.cisco.com ([173.37.255.139]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-02.cisco.com (Postfix) with ESMTPS id CA8761800023D for ; Fri, 16 Oct 2026 06:23:24 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 714D8CBF203; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 3/9] python3-pillow: Fix CVE-2026-59197 Date: Thu, 15 Oct 2026 23:23:17 -0700 Message-Id: <20261016062323.251925-4-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131057 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59197.patch | 74 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 75 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch new file mode 100644 index 0000000000..415866a19e --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59197.patch @@ -0,0 +1,74 @@ +From cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1 Mon Sep 17 00:00:00 2001 +From: Andrew Murray +Date: Sat, 20 Jun 2026 11:53:14 +1000 +Subject: [PATCH] Validate large filter sizes when initializing RankFilter + (#9695) + +CVE: CVE-2026-59197 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1] + +Backport Changes: +- Adapted the ImagingExpand check to Pillow 12.2.0's two-margin API. + It checks the larger margin and guards against zero before division; + the regression test passes both margins. + +(cherry picked from commit cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1) +Signed-off-by: Yogita Urade +--- + Tests/test_image_filter.py | 5 +++++ + src/PIL/ImageFilter.py | 3 +++ + src/libImaging/Filter.c | 5 +++++ + 3 files changed, 13 insertions(+) + +diff --git a/Tests/test_image_filter.py b/Tests/test_image_filter.py +index e566cd055..4bed605 100644 +--- a/Tests/test_image_filter.py ++++ b/Tests/test_image_filter.py +@@ -141,6 +141,11 @@ def test_rankfilter_properties() -> None: + assert rankfilter.size == 1 + assert rankfilter.rank == 2 + ++ with pytest.raises(ValueError, match="filter size too large"): ++ ImageFilter.RankFilter(23171, 1) ++ im = Image.new("1", (1, 1)) ++ with pytest.raises(ValueError, match="filter size too large"): ++ im.im.expand(23171, 23171) + + def test_builtinfilter_p() -> None: + builtin_filter = ImageFilter.BuiltinFilter() + +diff --git a/src/PIL/ImageFilter.py b/src/PIL/ImageFilter.py +index 9326eeeda..2c73c27bc 100644 +--- a/src/PIL/ImageFilter.py ++++ b/src/PIL/ImageFilter.py +@@ -99,6 +99,9 @@ class RankFilter(Filter): + name = "Rank" + + def __init__(self, size: int, rank: int) -> None: ++ if size * size * 4 > (2**31 - 1): ++ msg = "filter size too large" ++ raise ValueError(msg) + self.size = size + self.rank = rank + +diff --git a/src/libImaging/Filter.c b/src/libImaging/Filter.c +index cefb8fc..5288754 100644 +--- a/src/libImaging/Filter.c ++++ b/src/libImaging/Filter.c +@@ -54,11 +54,16 @@ Imaging + ImagingExpand(Imaging imIn, int xmargin, int ymargin) { + Imaging imOut; + int x, y; ++ int margin; + ImagingSectionCookie cookie; + + if (xmargin < 0 && ymargin < 0) { + return (Imaging)ImagingError_ValueError("bad kernel size"); + } ++ margin = xmargin > ymargin ? xmargin : ymargin; ++ if (margin > 0 && margin > (INT_MAX / (int)sizeof(FLOAT32)) / margin) { ++ return (Imaging)ImagingError_ValueError("filter size too large"); ++ } + + imOut = ImagingNewDirty( + imIn->mode, imIn->xsize + 2 * xmargin, imIn->ysize + 2 * ymargin diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index d5576560e7..f9d91e0889 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -11,6 +11,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-59204.patch \ file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \ file://CVE-2026-55380.patch \ + file://CVE-2026-59197.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:18 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101017 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5050CCA462 for ; Fri, 16 Oct 2026 06:23:35 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15655.1792131805770128006 for ; Thu, 15 Oct 2026 23:23:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=fQk6rzT8; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3652; q=dns/txt; s=iport01; t=1792131805; x=1793341405; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=NjqsIk5NILcMVM3doxQZqyUzXIMYjgglfmxE00vK5AQ=; b=fQk6rzT8oz65u43lkaUPNgbLFiZpaQY6mwLcEsJAVsLtMedO6hB7XzLE G5SZv5quFS7XUOFoM3nF20sGW6StntgWBZabh/M21JAOMmctrOu6RHVNN GxQ3OPGGsna/rd48knXhu33Hmy5PWgUhfRjbq5e6HqY+MhRQE/RXJPUAA cOBr7i6UQyW+CLhgZzwYOcptAh3C98MLG1d3WwhYDjWhUQEkrixGBRl7q zHHPd9v29tmfymahhLc8sjiERxXOisobFjtamjQIDnHg11ksoI0zikIcy dN/18292a73HtyRu0JO7Oh0IgRb6T32VpUNqikztdSYDCOULqIrEZwc2l Q==; X-CSE-ConnectionGUID: air1NNO6RS63L2OmU8ZYtw== X-CSE-MsgGUID: WibipU/7T2KEeMXbPmX//Q== X-IPAS-Result: A0BJAgBRwtFq/4z/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHSBeTOBAYMpAYFU2UqBaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWBO4IugQWBXAKBJ4Z+BIMcEoFalUdIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJlgQ4BKwV6RGkeMKUnoQ+EKIwilToaM4VbpRQLmH2LN4JTlk+EaYFoPIFZMxoIGxWDIglKGQ+OKw4Lg2CFZMh2JzICCQMvAQEHAgcOAwuBaJAAgX4BAQ IronPort-Data: A9a23:RcpVOqwc5VB53ul9kN16t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUDz GscXG+GOayCazH9KdwlYNyxoUwP68fVx4M1T1RpqFhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJEg3J9Q+3MEpO1oQr thCDzUwPiKym/3jldpXSsE07igiBNPgMIVavjRryivUSK59B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cO3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzaoaPJ4LTLSlTtnmZr GPewiOmPks5GdG6+TC990LrwdaayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7CQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:onLFHaOrTXjxR8BcTu2jsMiBIKoaSvp037BN7TEUdfU7SKKlfq yV8cjzkCWE6wr5O0tQ/OxoRpPgfZq0z/cciuMs1PWZLWvbUQCTQ72Kg7GP/9SZIU3D398Y87 t8eK5jD9C1J117gcHmpDScKb8bsb66GGTCv5am85+rJjsaDZ1d0w== X-Talos-CUID: 9a23:keeGB2lgJnyEiYGhlNvSJq28gIbXOXTc1i72BWjmM103E5nPblqtqJFVj9U7zg== X-Talos-MUID: 9a23:zjxuNw8J7DDuGgbat4SDqhWQf/hp6aW2NQdSrc8llsShBSZIPgfayw3iFw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536242561" Received: from rcdn-l-core-03.cisco.com ([173.37.255.140]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-03.cisco.com (Postfix) with ESMTPS id CD98A180001CD for ; Fri, 16 Oct 2026 06:23:24 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 76691CBF204; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 4/9] python3-pillow: Fix CVE-2026-59198 Date: Thu, 15 Oct 2026 23:23:18 -0700 Message-Id: <20261016062323.251925-5-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-03.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131059 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59198.patch | 57 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 58 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch new file mode 100644 index 0000000000..e794d26832 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59198.patch @@ -0,0 +1,57 @@ +From 49ea10f3c83475ad30c1b0581e2aaa3e75f4af4f Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Tue, 23 Jun 2026 09:46:33 +1000 +Subject: [PATCH] Prevent saving 1 mode images as TGA with run-length encoding + (#9709) + +CVE: CVE-2026-59198 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b] + +(cherry picked from commit eada3cbd7fb9963ee90673fb7b5270124a0d5f4b) +Signed-off-by: Yogita Urade +--- + Tests/test_file_tga.py | 12 +++++++++++- + src/PIL/TgaImagePlugin.py | 4 ++++ + 2 files changed, 15 insertions(+), 1 deletion(-) + +diff --git a/Tests/test_file_tga.py b/Tests/test_file_tga.py +index 7ec562342..82bcf48ca 100644 +--- a/Tests/test_file_tga.py ++++ b/Tests/test_file_tga.py +@@ -179,10 +179,20 @@ def test_save_wrong_mode(tmp_path: Path) -> None: + im = hopper("PA") + out = tmp_path / "temp.tga" + +- with pytest.raises(OSError): ++ with pytest.raises(OSError, match="cannot write mode PA as TGA"): + im.save(out) + + ++def test_save_1_mode_rle(tmp_path: Path) -> None: ++ im = Image.new("1", (1, 1)) ++ out = tmp_path / "temp.tga" ++ ++ with pytest.raises( ++ OSError, match="cannot write mode 1 as TGA with run-length encoding" ++ ): ++ im.save(out, compression="tga_rle") ++ ++ + def test_save_mapdepth() -> None: + # This image has been manually hexedited from 200x32_p_bl_raw.tga + # to include an origin +diff --git a/src/PIL/TgaImagePlugin.py b/src/PIL/TgaImagePlugin.py +index b2989a4b7..8fd63b1df 100644 +--- a/src/PIL/TgaImagePlugin.py ++++ b/src/PIL/TgaImagePlugin.py +@@ -205,6 +205,10 @@ def _save(im: Image.Image, fp: IO[bytes], filename: str | bytes) -> None: + compression = im.encoderinfo.get("compression", im.info.get("compression")) + rle = compression == "tga_rle" + if rle: ++ if im.mode == "1": ++ msg = f"cannot write mode {im.mode} as TGA with run-length encoding" ++ raise OSError(msg) ++ + imagetype += 8 + + id_section = im.encoderinfo.get("id_section", im.info.get("id_section", "")) diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index f9d91e0889..331b99622b 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-54059_CVE-2026-54060_CVE-2026-55379.patch \ file://CVE-2026-55380.patch \ file://CVE-2026-59197.patch \ + file://CVE-2026-59198.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:19 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101014 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9907CCA48F for ; Fri, 16 Oct 2026 06:23:35 +0000 (UTC) Received: from rcdn-iport-5.cisco.com (rcdn-iport-5.cisco.com [173.37.86.76]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15654.1792131805734630105 for ; Thu, 15 Oct 2026 23:23:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=ghIzV66z; spf=pass (domain: cisco.com, ip: 173.37.86.76, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4185; q=dns/txt; s=iport01; t=1792131806; x=1793341406; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=0tbJlo8WCTIlGmaHpH7TBsV5KZdNb7UAsR11vNViaHA=; b=ghIzV66zhcAfIcwl7QOu1BnXzKtmh3edvWFkv8oThwhar5SzebQ36jKd G2z4IXRKC+kxXQMomXXKQGfLs4faC8GsgBrrliukJ/EU8S2/GmxzV1rB+ d06bBpxATHECJTrd/Y8PiW/FIds4OPpHkBTMjcPix4ZmxdSkj6B5bIpX2 jr9DNg5CZMzCUB1zEFrcntQShGRN25GVp4ML/oDz2OcnzlxnhjnIHRDC3 LtWFqm8V8Yzssndg0mP2PQMwMLWmX1k/ViW0m8fXkjEzGPQFY9KQkZbBc +LMY7KLFXsdWt9mGxaTS4qgdsFGHttvYmJOV9BKBADNSaYREkc9xEwZG3 w==; X-CSE-ConnectionGUID: owF1SAI0S4K5wPUICInaeg== X-CSE-MsgGUID: Giq2bM2yT5uN4SxthZVovg== X-IPAS-Result: A0BJAgBfwdFq/5X/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHOBeTOBAYMpAYFU2UqBaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWBO4IugQWBXAKIJQSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZTFdASsFeoEtHqVXoQ+EKIwilToaM4VbpRQLmH2LN4JTlk+EaYFoPIFZMxoIGxWDIglKGQ+OLgsLg2DOWicyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:zXjJuqyVwGgsI9ph4596t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkUGm mBNW2jTPP3YYjPwLYh0aN+2/BxQuZ+Bn4IyTwVoqlhgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJEYpE9Qj08cvOj1tq OMgFREmTxaKiu3jldpXSsE07igiBNPgMIVavjRryivUSK98B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2cMnWjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzbIqLJYPRLSlTtmmZv zjM2j7oPkwHEoCk2SaFwEyrmOCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl/DQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSj1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:z/KD2aspmoQ6wBoQjMMSxEy07skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:VhRmOGxIpic4Db1YAQLDBgUTBe58SVT8lEyMABKnMVtIY5yTQFKfrfY= X-Talos-MUID: 9a23:yBowCgbTQrPCReBTmD713jtHbtZUvrmIVHsdjZU0hc6aOnkl X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536486773" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-5.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 2BDBF18000335 for ; Fri, 16 Oct 2026 06:23:25 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 7B50FCBF21E; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 5/9] python3-pillow: Fix CVE-2026-59199 Date: Thu, 15 Oct 2026 23:23:19 -0700 Message-Id: <20261016062323.251925-6-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131061 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4 Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59199.patch | 84 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 85 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch new file mode 100644 index 0000000000..4418b73e99 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59199.patch @@ -0,0 +1,84 @@ +From 0d706085cfb87ffac6eea54f1a42ce8bd3f16513 Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Mon, 22 Jun 2026 12:56:41 +1000 +Subject: [PATCH] Use int64_t to calculate paste box dimensions (#9703) + +CVE: CVE-2026-59199 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b] + +(cherry picked from commit ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b) +Signed-off-by: Yogita Urade +--- + Tests/test_image_paste.py | 14 ++++++++++++++ + src/libImaging/Paste.c | 12 ++++++------ + 2 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/Tests/test_image_paste.py b/Tests/test_image_paste.py +index 37e4df103..f9b72e46f 100644 +--- a/Tests/test_image_paste.py ++++ b/Tests/test_image_paste.py +@@ -357,6 +357,20 @@ class TestImagingPaste: + im.copy().paste(im2) + im.copy().paste(im2, (0, 0)) + ++ @pytest.mark.parametrize( ++ "box", ++ ( ++ (2**31 - 1, 0, -(2**31), 1), ++ (0, 2**31 - 1, 1, -(2**31)), ++ ), ++ ) ++ def test_overflow(self, box: tuple[int, int, int, int]) -> None: ++ im = Image.new("1", (1, 1)) ++ im.paste(1, box) ++ ++ with pytest.raises(ValueError, match="images do not match"): ++ im.paste(im.copy(), box) ++ + def test_incorrect_abbreviated_form(self) -> None: + im = Image.new("L", (1, 1)) + with pytest.raises(ValueError): +diff --git a/src/libImaging/Paste.c b/src/libImaging/Paste.c +index f4b72c5d8..bf72d3a1c 100644 +--- a/src/libImaging/Paste.c ++++ b/src/libImaging/Paste.c +@@ -274,7 +274,7 @@ int + ImagingPaste( + Imaging imOut, Imaging imIn, Imaging imMask, int dx0, int dy0, int dx1, int dy1 + ) { +- int xsize, ysize; ++ int64_t xsize, ysize; + int pixelsize; + int sx0, sy0; + ImagingSectionCookie cookie; +@@ -286,8 +286,8 @@ ImagingPaste( + + pixelsize = imOut->pixelsize; + +- xsize = dx1 - dx0; +- ysize = dy1 - dy0; ++ xsize = (int64_t)dx1 - dx0; ++ ysize = (int64_t)dy1 - dy0; + + if (xsize != imIn->xsize || ysize != imIn->ysize || pixelsize != imIn->pixelsize) { + (void)ImagingError_Mismatch(); +@@ -598,7 +598,7 @@ ImagingFill2( + Imaging imOut, const void *ink, Imaging imMask, int dx0, int dy0, int dx1, int dy1 + ) { + ImagingSectionCookie cookie; +- int xsize, ysize; ++ int64_t xsize, ysize; + int pixelsize; + int sx0, sy0; + +@@ -609,8 +609,8 @@ ImagingFill2( + + pixelsize = imOut->pixelsize; + +- xsize = dx1 - dx0; +- ysize = dy1 - dy0; ++ xsize = (int64_t)dx1 - dx0; ++ ysize = (int64_t)dy1 - dy0; + + if (imMask && (xsize != imMask->xsize || ysize != imMask->ysize)) { + (void)ImagingError_Mismatch(); diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index 331b99622b..5acd020d8f 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-55380.patch \ file://CVE-2026-59197.patch \ file://CVE-2026-59198.patch \ + file://CVE-2026-59199.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101018 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBC87CCA490 for ; Fri, 16 Oct 2026 06:23:35 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15655.1792131805770128006 for ; Thu, 15 Oct 2026 23:23:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=dRaRMgQ8; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4160; q=dns/txt; s=iport01; t=1792131806; x=1793341406; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=IbGHYDQQx7SRTUh8gWMB01AajCXKmVsuC6rJwzM1Tlc=; b=dRaRMgQ8FVY946JvpSWpgpa53xJvlVEJ66QMillF7zKtZdE5g78DY+yf hiy2Ct4bupNLDkR20JBnvmhMgFtM/nzbncyaRcJxVwCZjNMVCOqbTI7yx 3tlVKbj0PFjLsnUOy8ODJfzQ4ZJJYSV2SIWI16mbA1qykh+P40BEDvNv6 pdIUeoy4OCd5rFIO7NBt+sLOnyO2YaBHKK/OKWvLl1QGUlkjBDbuApmTJ KbmSA+y3+A7Q2THhM6MmIC8eT1NjKmfsOhwx26qFeAGcRriiYt5xcs8O9 jz7aIXZSBEsjpu6Is/TOVNbdSDV+9sJI43klv/P8BkQp/Y+kxI4tHpYJl w==; X-CSE-ConnectionGUID: SYrDg3whSkWqboK7A1/kDQ== X-CSE-MsgGUID: NTIFJfGPRPe2mgi2OzTJjw== X-IPAS-Result: A0BIAgBRwtFq/4r/Ja1aHgEBCxIMggULgld1YENJA5QmgiEDnhyBfg8BAQEPRA0EAQGEP0YCjhUCJjQJDgECBAMCAwEBAQEBAQEBAQEBAQoBAQUBAQECAQcFgQ4Thk8NkBIBAgEDJwsBGAE9HAMBAi8rIwgZgwIBgnQDEbx0gXkzgQGDKQGBVNlKgWgBCxQBgTiFQIgjXRgBhHwnG4FJRIEVgTuCLoEFgVwCiCUEgxwSgVqVR0iBHgNZLAFVEw0KCwcFgWgDNRIqFW4yHYEjPheBBxsGBYEdgSCCFiMZNnqBCV6BKylhEBeBCYIHAoJUggACAUlBDgdFUwklQxJHJiIIEgkBExowC4EbODwJKEEXDHMMHQVyCAINCQcpGA1IESw3FRkEPm4HkhQegmWBDgErf4EtHqM2giGhD4QojCKVOhozhVulFAuYfYs3glOWT4RpgWg8gVkzGggbFYMiCUoZD44rDguDYIVkyHYnMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:tfzav6x4Rdtzo37xBxx6t+dhxyrEfRIJ4+MujC+fZmUNrF6WrkVTm 2YcWTqPOvrfNmanedlwYN6z8UlSvpKBn4VkSAdk/1hgHilAwSbn6Xt1DatR0we6dJCroJdPt p1GAjX4BJlqCCKa/lHyYuCJQUBUjcmgXqD7BPPPJhd/TAplTDZJoR94kobVuKYw6TSCK13L4 4yaT/H3Ygf/hWcsazxMsspvlTs21BjMkGJA1rABTagjUG/2zxE9EJ8ZLKetGHr0KqE8NvK6X evK0Iai9Wrf+Ro3Yvv9+losWhRXKlJ6FVHmZkt+A8BOsDAbzsAB+vpT2M4nVKtio27hc+adZ zl6ncfYpQ8BZsUgkQmGOvVSO3kW0aZuoNcrLZUj2CCe5xWuTpfi/xlhJHoHJ6EXofl3OmJx7 PYfC28kN1eAq9vjldpXSsE07igiBNPgMIVavjRryivUSK5/B5vCWK7No9Rf2V/chOgXQq2YP JVfM2cyKk2bM3WjOX9PYH46tPa1nHDzfhVTqUmeouw85G27IAlZjeOzaoaPJ4LRLSlTtmCkh 0zk8UvBOCkXbtmQyGCi4E6OhPCayEsXX6pXTtVU7MVCh0WewGEWAhAaWVa35PW0lEO6c9ZeM FAPvC02oK4/8UamQtXwU1u/unHsg/IHc8BbH+t/7ESGzbDZpl7AQGMFVTVGLtchsafaWAAX6 7NApPuxbRQHjVFfYSv1Gmu8xd9qBRUoEA== IronPort-HdrOrdr: A9a23:1ebnw6AJ987VijDlHemA55DYdb4zR+YMi2TDsHoBLSC9Hfb3qy nDppkmPFrP+VUssRIb6LW90de7IE80nKQdieJ6AV7hZniFhILCFu5fBOXZrwEIYxefysdtkY F9bqN5FNr8SXJ+jcr8/U2ENuxI+qjhzEht7t2utkuEimpRGsdd0zs= X-Talos-CUID: 9a23:lU+YFWDxVvfd0L/6ExJW7mIbQd8lSX7i1X3XABCRUCFqZITAHA== X-Talos-MUID: 9a23:K8eWcAnQrzJm8r9/l6uvdnpECOZGwaqBMHo1nM8DtMjeEj5MGTWC2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536242563" Received: from rcdn-l-core-01.cisco.com ([173.37.255.138]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-01.cisco.com (Postfix) with ESMTPS id 2C9EF1800028F for ; Fri, 16 Oct 2026 06:23:25 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 80C4ECBEF8A; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 6/9] python3-pillow: Fix CVE-2026-59200 Date: Thu, 15 Oct 2026 23:23:20 -0700 Message-Id: <20261016062323.251925-7-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-01.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131062 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565 Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59200.patch | 82 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 83 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch new file mode 100644 index 0000000000..ee5f0b6db5 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59200.patch @@ -0,0 +1,82 @@ +From 9ce0814ba3aec3d4ba57f15593ebe063bf5ea205 Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Tue, 30 Jun 2026 09:17:05 +1000 +Subject: [PATCH] Add max_length to PdfStream decode() (#9718) + +CVE: CVE-2026-59200 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09] + +(cherry picked from commit f7a31ea75e460e108c37126da1f47812f21f6b09) +Signed-off-by: Yogita Urade +--- + Tests/test_pdfparser.py | 11 +++++++++++ + src/PIL/PdfParser.py | 15 +++++++++------ + 2 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/Tests/test_pdfparser.py b/Tests/test_pdfparser.py +index cba6cd053..4c522eb7a 100644 +--- a/Tests/test_pdfparser.py ++++ b/Tests/test_pdfparser.py +@@ -1,6 +1,7 @@ + from __future__ import annotations + + import time ++import zlib + + import pytest + +@@ -95,6 +96,16 @@ def test_parsing() -> None: + assert time.strftime("%Y%m%d%H%M%S", getattr(d, name)) == value + + ++def test_pdfstream_flatedecode() -> None: ++ d = PdfDict({b"Filter": b"FlateDecode"}) ++ buf = zlib.compress(b"test") ++ s = PdfStream(d, buf) ++ assert s.decode() == b"test" ++ ++ with pytest.raises(ValueError, match="Decompressed data too large"): ++ s.decode(3) ++ ++ + def test_pdf_repr() -> None: + assert bytes(IndirectReference(1, 2)) == b"1 2 R" + assert bytes(IndirectObjectDef(*IndirectReference(1, 2))) == b"1 2 obj" +diff --git a/src/PIL/PdfParser.py b/src/PIL/PdfParser.py +index f7f3a4643..10079ac66 100644 +--- a/src/PIL/PdfParser.py ++++ b/src/PIL/PdfParser.py +@@ -10,6 +10,8 @@ import time + import zlib + from typing import Any, NamedTuple + ++from . import ImageFile ++ + TYPE_CHECKING = False + if TYPE_CHECKING: + from typing import IO +@@ -320,17 +322,18 @@ class PdfStream: + self.dictionary = dictionary + self.buf = buf + +- def decode(self) -> bytes: ++ def decode(self, max_length: int = ImageFile.SAFEBLOCK) -> bytes: + try: + filter = self.dictionary[b"Filter"] + except KeyError: + return self.buf + if filter == b"FlateDecode": +- try: +- expected_length = self.dictionary[b"DL"] +- except KeyError: +- expected_length = self.dictionary[b"Length"] +- return zlib.decompress(self.buf, bufsize=int(expected_length)) ++ dobj = zlib.decompressobj() ++ plaintext = dobj.decompress(self.buf, max_length) ++ if dobj.unconsumed_tail: ++ msg = "Decompressed data too large" ++ raise ValueError(msg) ++ return plaintext + else: + msg = f"stream filter {repr(filter)} unknown/unsupported" + raise NotImplementedError(msg) diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index 5acd020d8f..3a2efbf851 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -14,6 +14,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-59197.patch \ file://CVE-2026-59198.patch \ file://CVE-2026-59199.patch \ + file://CVE-2026-59200.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101013 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A72E2CC6B38 for ; Fri, 16 Oct 2026 06:23:35 +0000 (UTC) Received: from rcdn-iport-4.cisco.com (rcdn-iport-4.cisco.com [173.37.86.75]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15655.1792131805770128006 for ; Thu, 15 Oct 2026 23:23:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=JIP2geq4; spf=pass (domain: cisco.com, ip: 173.37.86.75, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3235; q=dns/txt; s=iport01; t=1792131806; x=1793341406; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=tO1f+xHa1fuEwoP9Oygl8+Md9ooZscO5yhBMfOexx8U=; b=JIP2geq4GScupT8vbqpj/KvxC3h0GNsQ3930YQqWfKp5uWIE8wv/2jP8 Fkk+N5v2RrTYE7FzUwvZba2ivsl42OArT+BuDiY34Qt6Kr7WS7cdSSeT8 byDViW7FDkB7nEoGtGFoTRpBYSRx26T38uIrqMC6hqWhcD8Y80U6jpx/x /VncGn739ecV0qcHlC/BME9SrwppBDlbuT15bg73gCOVqX4UvnKcuzB0x 0xYr3lh++v/ALBB2Pq8QZToRw4pGKNL5sT3kslG9q3dN+vjpoKLypFmvC EorckLQZKY78fh40lNRDyxnZYnPLwqMjsaHNYrnLjWNHyX7t6HE3visK9 w==; X-CSE-ConnectionGUID: +XjLbfKmShqlY6FI9ub1pA== X-CSE-MsgGUID: HONV5rjZRImsdmjTnpCU5Q== X-IPAS-Result: A0BJAgBRwtFq/5T/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHSBeTOBAYMpAYFU2UqBaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWBO4IugQWBXAKIJQSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZYEOASsFehKBGx6lV6EPhCiMIpU6GjOFW6UUC5h9izeCU5ZPhGmBaDyBWTMaCBsVgyIJShkPjjmDa4VkyHYnMgIJAy8BAQcCBw4DC4FokX4BAQ IronPort-Data: A9a23:CG7PD6qAxKaJUBaFE6jP4wIpTQheBmJOZBIvgKrLsJaIsI4StFCzt garIBnVPqmNYGr0coska9zkoR8EuJ7VyoNhHgporXs8QS8QpOPIVI+TRqvS04x+DSFioGZPt Zh2hgzodZhsJpPkjk7zdOWn9T8jhfngqoPUUIbsIjp2SRJvVBAvgBdin/9RqoNziLBVOSvV0 T/Ji5OZYgDNNwJcaDpOtfvb8U035ZwehRtB1rAATaET1LPhvyF94KI3fcmZM3b+S49IKe+2L 86r5K255G7Q4yA2AdqjlLvhGmVSKlIFFVHT4pb+c/HKbilq/kTe4I5iXBYvQRs/ZwGyojxE4 I4lWapc5useFvakdOw1C3G0GszlVEFM0OevzXOX6aR/w6BaGpfh660GMa04AWEX0qVHA0VE+ 98dEzAUaiHdqcPn3bjiUsA506zPLOGzVG8ekmtrwTecCbMtRorOBvyTo9RZxzw3wMtJGJ4yZ eJANmEpN0uGOUASfA5LWPrSn8/w7pX7WyxFsluZqII84nPYy0p6172F3N/9J4fUH5kPwxjGz o7A10TeJC9HLt6t8xuA6X6phNPJhQjGBbtHQdVU8dYv2jV/3Fc7DwUbU1a+q/S1hkOyHt5SN UEQ0i4vtrQpskuzQ9/wWhe1rHKJslgbQdU4LgEhwBuGxqyR50OSAXIJC2cYLtcnr8QxAzct0 zdlgu/UONCmi5XNIVr1y1tehWna1fQ9RYPaWRI5cA== IronPort-HdrOrdr: A9a23:40N0oqrF9BoxqxhbWIDi/CQaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:18l27GyvCdQAAw3MD/QZBgVXKsIBeHP+yUzQOkuJV0hIGaCfEEe5rfY= X-Talos-MUID: 9a23:cfEFrA1vX8aXf7ufZqfjcggyODUjw4OINh0Xk6c8msyfOSlyBzGFpwnqe9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536242566" Received: from rcdn-l-core-11.cisco.com ([173.37.255.148]) by rcdn-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-11.cisco.com (Postfix) with ESMTPS id 2F0F1180002E6 for ; Fri, 16 Oct 2026 06:23:25 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 85EC4CBEF98; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 7/9] python3-pillow: Fix CVE-2026-59203 Date: Thu, 15 Oct 2026 23:23:21 -0700 Message-Id: <20261016062323.251925-8-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-11.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131064 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798 Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59203.patch | 45 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 46 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59203.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59203.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59203.patch new file mode 100644 index 0000000000..73dad2b301 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59203.patch @@ -0,0 +1,45 @@ +From 157289420e2b730688452c58a95a89974b25538d Mon Sep 17 00:00:00 2001 +From: Andrew Murray <3112309+radarhere@users.noreply.github.com> +Date: Tue, 23 Jun 2026 09:20:48 +1000 +Subject: [PATCH] Raise ValueError if EPS BeginBinary bytecount is negative + (#9708) + +CVE: CVE-2026-59203 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83] + +(cherry picked from commit 03992618118b4a76b6163cd72ab5ecd684133b83) +Signed-off-by: Yogita Urade +--- + Tests/test_file_eps.py | 4 ++++ + src/PIL/EpsImagePlugin.py | 3 +++ + 2 files changed, 7 insertions(+) + +diff --git a/Tests/test_file_eps.py b/Tests/test_file_eps.py +index d4e8db4f4..d1886e9e2 100644 +--- a/Tests/test_file_eps.py ++++ b/Tests/test_file_eps.py +@@ -204,6 +204,10 @@ def test_begin_binary() -> None: + with Image.open(io.BytesIO(data)) as img: + assert img.size == (399, 480) + ++ data[76867:76873] = b" -1" ++ with pytest.raises(ValueError, match="BeginBinary bytecount cannot be negative"): ++ Image.open(io.BytesIO(data)) ++ + + @mark_if_feature_version( + pytest.mark.valgrind_known_error, "libjpeg_turbo", "2.0", reason="Known Failing" +diff --git a/src/PIL/EpsImagePlugin.py b/src/PIL/EpsImagePlugin.py +index aeb7b0c93..363ba19e1 100644 +--- a/src/PIL/EpsImagePlugin.py ++++ b/src/PIL/EpsImagePlugin.py +@@ -357,6 +357,9 @@ class EpsImageFile(ImageFile.ImageFile): + trailer_reached = True + elif bytes_mv[:14] == b"%%BeginBinary:": + bytecount = int(byte_arr[14:bytes_read]) ++ if bytecount < 0: ++ msg = "BeginBinary bytecount cannot be negative" ++ raise ValueError(msg) + self.fp.seek(bytecount, os.SEEK_CUR) + bytes_read = 0 + diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index 3a2efbf851..c9926ba076 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -15,6 +15,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-59198.patch \ file://CVE-2026-59199.patch \ file://CVE-2026-59200.patch \ + file://CVE-2026-59203.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101015 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEDECCCA46D for ; Fri, 16 Oct 2026 06:23:35 +0000 (UTC) Received: from rcdn-iport-6.cisco.com (rcdn-iport-6.cisco.com [173.37.86.77]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.15945.1792131805649821057 for ; Thu, 15 Oct 2026 23:23:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=eFz1PsR0; spf=pass (domain: cisco.com, ip: 173.37.86.77, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=4140; q=dns/txt; s=iport01; t=1792131805; x=1793341405; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=5gXpAin5fgoSX+IWw63mDs+vFJsYhW7BAUKVRZ7rZmA=; b=eFz1PsR02nhhyBvoWoWJRIjhSdDbHnkauPAiKlcEJMuk2jHsgSo+1fhk o6j6a7c62SmIuoPGzLMJPVYHRzwi2Nbv1FP5x2WLHA/8RjABjYHo/05Zb ZHan9xidSXZZqGrJQbthPAsQ57MHWa1OIkyp9i6FkBxZ7CsfyYrdSZ9h+ UTXR4IT7EFVz6PEl+dlvbpaLdgVL5c5chdYLOCCYWSAG5iXo4vhP+2XBe DHjaWN/kSbS3rJPCrQAj5s1BdeP7Dl1f01IJ7/h2+YCzoK3bKUzwbQOZ0 bH+9QycZFmrR1UAh6XzTrgtx1Sh0R/5sZGJ8u7ZacAB5bDvmAcsagkb5i Q==; X-CSE-ConnectionGUID: OwIrLxqzRVKwJwUgqzD3Ew== X-CSE-MsgGUID: Es1vXA/4QNy4Ena0HIu6Xw== X-IPAS-Result: A0BJAgBfwdFq/5X/Ja1aglmCV3VgQ0kDlCaCIQOeHIF+DwEBAQ9EDQQBAYQ/RgKOFQImNAkOAQIEAwIDAQEBAQEBAQEBAQEBCgEBBQEBAQIBBwWBDhOGTw2QEgECAQMnCwEYAT0cAwECLysjCBmDAgGCdAMRvHOBeTOBAYMpAYFU2UqBaAELFAGBOIVAiCNdGAGEfCcbgUlEgRWBO4IugQWBXAKIJQSDHBKBWpVHSIEeA1ksAVUTDQoLBwWBaAM1EioVbjIdgSM+F4EHGwYFgR2BIIIWIxk2eoEJXoErKWEQF4EJggcCglSCAAIBSUEOB0VTCSVDEkcmIggSCQETGjALgRs4PAkoQRcMcwwdBXIIAg0JBykYDUgRLDcVGQQ+bgeSFB6CZXsTASsFeoEtHpMXkkChD4QojCKVOhozhVulFAuYfYs3glOJD41AhGmBaDyBWTMaCBsVgyIJShkPjjmDa4JZgwvIdicyAgkDLwEBBwIHDgMLgWiRfgEB IronPort-Data: A9a23:OMP3a6DjWL1zIhVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApDolhTVWm jFLUGyDafaDZ2qnLd1zaYuz/RtUu5/Vn4VjOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGcYZsCCCM/n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXGthh fuo+5eBYQf8hWYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE5OpPFmUmJJ8ixMVoI35z+ uUKBGsgcUXW7w626OrTpuhEnM8vKozveYgYoHwllGufBvc9SpeFSKLPjTNa9G5v3YYVQrCEO pdfMGY+BPjDS0Un1lM/GY8kleulrnL+aDZf7lmSoMLb5kCOl1IogeS8bIO9ltqiaN4MgHax4 T7/2XWlLxcTbPy+1GS17Sf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTWValrP2Rjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWspBUQXZ9UVuY98gzIk/CS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH6dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:+rGyZquTbiCuQvOTz+ncvYNh7skDWtV00zEX/kB9WHVpm6uj5q STdZsguyMc5Ax9ZJhko6HiBEDiewK4yXcK2+gs1N6ZNWGM0ldAbrsSj7cKqAeOJ8SRzIJgPN 9bE5RWOZnXEUVwi9r87U2TFtYtx8TCzYWT7N2uqEuEiWpRGthdB8ATMHf8LnFL X-Talos-CUID: 9a23:pLXnDWNRPPujU+5DfzZG7moEA9IfTF7C7mjtLFaqJT1EV+jA X-Talos-MUID: 9a23:iIZVjw2UQMC/K01/V491PxBZODUjzr/3FnAk1sk/ndjYGCp5Yxe8kWqHXdpy X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="536194941" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-6.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 3231618000336 for ; Fri, 16 Oct 2026 06:23:25 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 8A610CBEFAB; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 8/9] python3-pillow: Fix CVE-2026-59205 Date: Thu, 15 Oct 2026 23:23:22 -0700 Message-Id: <20261016062323.251925-9-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:35 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131060 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 Signed-off-by: Yogita Urade --- .../python3-pillow/CVE-2026-59205.patch | 66 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch new file mode 100644 index 0000000000..5cac7e05d1 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch @@ -0,0 +1,66 @@ +From a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 Mon Sep 17 00:00:00 2001 +From: Andrew Murray +Date: Sat, 20 Jun 2026 21:18:14 +1000 +Subject: [PATCH] Raise error if image modes do not match ImageCms transform + modes (#9715) + +CVE: CVE-2026-59205 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721] + +(cherry picked from commit 066e349b8e20f6e0400683ff988ac72eea24c049) +(cherry picked from commit 7f6e9d696913bba9fd1a6cf0b53f4a313dc25329) +(cherry picked from commit 642d806703c62d4160f3eb8ff25fb63cbedadd98) +Signed-off-by: Yogita Urade +--- + Tests/test_imagecms.py | 4 ++++ + src/PIL/ImageCms.py | 16 +++++++++------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py +index d73ab34282b..3382a34e47c 100644 +--- a/Tests/test_imagecms.py ++++ b/Tests/test_imagecms.py +@@ -196,6 +196,10 @@ def test_exceptions() -> None: + psRGB = ImageCms.createProfile("sRGB") + pLab = ImageCms.createProfile("LAB") + t = ImageCms.buildTransform(pLab, psRGB, "LAB", "RGB") ++ with pytest.raises(ValueError, match="mode mismatch"): ++ t.apply(hopper("RGBA")) ++ with pytest.raises(ValueError, match="mode mismatch"): ++ t.apply(hopper("LAB"), hopper("RGBA")) + with pytest.raises(ValueError, match="mode mismatch"): + t.apply_in_place(hopper("RGBA")) + +diff --git a/src/PIL/ImageCms.py b/src/PIL/ImageCms.py +index 513e28acf..388a9296f 100644 +--- a/src/PIL/ImageCms.py ++++ b/src/PIL/ImageCms.py +@@ -317,19 +317,21 @@ class ImageCmsTransform(Image.ImagePointHandler): + return self.apply(im) + + def apply(self, im: Image.Image, imOut: Image.Image | None = None) -> Image.Image: +- if imOut is None: ++ if im.mode != self.input_mode: ++ msg = "mode mismatch" ++ raise ValueError(msg) ++ if imOut is not None: ++ if imOut.mode != self.output_mode: ++ msg = "mode mismatch" ++ raise ValueError(msg) ++ else: + imOut = Image.new(self.output_mode, im.size, None) + self.transform.apply(im.getim(), imOut.getim()) + imOut.info["icc_profile"] = self.output_profile.tobytes() + return imOut + + def apply_in_place(self, im: Image.Image) -> Image.Image: +- if im.mode != self.output_mode: +- msg = "mode mismatch" +- raise ValueError(msg) # wrong output mode +- self.transform.apply(im.getim(), im.getim()) +- im.info["icc_profile"] = self.output_profile.tobytes() +- return im ++ return self.apply(im, im) + + + def get_display_profile(handle: SupportsInt | None = None) -> ImageCmsProfile | None: diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index c9926ba076..e5ef7b34bf 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -16,6 +16,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-59199.patch \ file://CVE-2026-59200.patch \ file://CVE-2026-59203.patch \ + file://CVE-2026-59205.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f" From patchwork Fri Oct 16 06:23:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yogita Urade X-Patchwork-Id: 101016 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B763CCA491 for ; Fri, 16 Oct 2026 06:23:36 +0000 (UTC) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.15656.1792131806146579952 for ; Thu, 15 Oct 2026 23:23:26 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=GascOJ6P; spf=pass (domain: cisco.com, ip: 173.37.86.78, mailfrom: yurade@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=1132; q=dns/txt; s=iport01; t=1792131806; x=1793341406; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=G0bV0whJkYdiafSMOt+3FwZ513Y95JQilErk7oqP3cg=; b=GascOJ6PC+PgGaBBr6CiJXod4KRVXN2GUtS6gwSBc1fJOfiqejLWAjCr nGqrNOz2wfcyp1LfJyjLK3k3vTm4Bkukp2swnxlrJZxJLfFEcGVfSC+PB 9avCbMOkNzZiF1kR8R3CjuKMBbo80I+lz2cjdlU8DadElxirdBCtu56s9 ofCbjGDUEDMbO5YEj3KEJnmZm1CFHdIq/JokITy8gL793wLe46jAOOPt4 VLwBd/dSGyF499VnqYr7/qLw+3W9gtIaT2EK+dkFBC0VlJRGksQMZmc/n n+Mom49IRxCK37k5yFcBLhajhiLZSRb2JjVlZx9Tbsa9giTwNRKnPwf/q Q==; X-CSE-ConnectionGUID: AiepZ07IRlCWqcweBMTrQg== X-CSE-MsgGUID: 05i2Zc6fSp6yzx+kTulf9g== X-IPAS-Result: A0DIAgBfwdFq/5X/Ja1aglmCV3VgQ0kDlCaDN50JgX4PAQEBD0QNBAEBhD9GAo4VAiY1CA4BAgQDAgMBAQEBAQEBAQEBAQEKAQEFAQEBAgEHBYEOE4ZPDZATAgEDMgEYAT1RKx0BDRmDAgGCdAMRvHOCLIEBgykBgVTZSoFoAQsUAYE4jWN1AYR8JxuBSUSBFYJzdoEFgVwCgi2FeASDLoF4lSlIgR4DWSwBVRMNCgsHBYFoAzUSKhVuMh2BIz4XgQcbBgWBHYEgghYjGTZ6gQlegSspYRAXgQmCBwKCVIIAAgFJQQ4HRVMJJUMSRyYiCBIJARMaMAuBGzg8CShBFwxzDB0FcggCDQkHKRgNSBEsNxUZBD5uB5IUHoJlgQ4sgiyldaEPhCiMIpU6GjOqbwsjmFqOCpZPhGmBaQE6gVkzGggbFYMiCUoZD445g2vOWicyAgwvAQEHAgcOAwuBaJF+AQE IronPort-Data: A9a23:ILig/6/LDFSEFmjLUw/iDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3z WQWWTyGPanbZ2H0eosjbIyw/R8AsZ/XyYdrSAU6+H1EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmB4E/rbei5xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mtyyHjEAX9gWAtajtKs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kfPIAAyL4oIFtK3 sMBIy8ARDW/ndu5lefTpulE3qzPLeHxN48Z/3UlxjbDALN/G9bIQr7B4plT2zJYasJmRKmFI ZFGL2AyMVKZP0wn1lQ/UPrSmM+5m2P2fzBwo1OOrq1x6G/WpOB0+OW2bYSMIYbVHa25mG7A+ 2OczW+nDCoCas2N2XmGzm+oiL7AyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJKGOE8rQXIwa3O7kPAXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rEnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:e7ILIaqtBz3khMMNpZRIAbQaV5oHeYIsimQD101hICG9Ffbo8/ xG88506faZslsssTQb6LO90cq7MBbhHOBOgLX5VI3KNGKNhILrFvAB0WKI+VLd8kPFmtK1rZ 0BT4FOTPvtEFN9kcH2pCO8E9om3Z271ZrAv5a485+oJjsaEp2JKGxCe2CmLnE= X-Talos-CUID: 9a23:Ac2D12hvOIOK5jzlUeB5aYYYJjJuW3zQ1EWIfG6CDU1WUbaKRHW1xLldnJ87 X-Talos-MUID: 9a23:xWPVvwzorigKnGrDvUOERTScTf6aqPzzCRo/mssIgNHaJD5geDShkTC5E4Byfw== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.27,161,1787011200"; d="scan'208";a="535613270" Received: from rcdn-l-core-12.cisco.com ([173.37.255.149]) by rcdn-iport-7.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 16 Oct 2026 06:23:25 +0000 Received: from sjc-ads-7871.cisco.com (sjc-ads-7871.cisco.com [10.30.222.158]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by rcdn-l-core-12.cisco.com (Postfix) with ESMTPS id 324F118000338 for ; Fri, 16 Oct 2026 06:23:25 +0000 (GMT) Received: by sjc-ads-7871.cisco.com (Postfix, from userid 1889728) id 8FA0ACBEFBF; Thu, 15 Oct 2026 23:23:24 -0700 (PDT) From: Yogita Urade To: openembedded-devel@lists.openembedded.org Subject: [meta-python][wrynose][PATCH 9/9] python3-pillow: CVE_STATUS for CVE-2026-55798 Date: Thu, 15 Oct 2026 23:23:23 -0700 Message-Id: <20261016062323.251925-10-yurade@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20261016062323.251925-1-yurade@cisco.com> References: <20261016062323.251925-1-yurade@cisco.com> MIME-Version: 1.0 X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-7871.cisco.com [10.30.222.158];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.30.222.158, sjc-ads-7871.cisco.com X-Outbound-Node: rcdn-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Fri, 16 Oct 2026 06:23:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/131063 Analysis: - The vulnerable code is WindowsViewer.get_command() constructing an unescaped cmd.exe command from a file path. [1] - Linux uses UnixViewer, which quotes the path, so this Windows command path is not used by the target recipe. [1] - Hence marking this CVE not applicable for the Linux target. [1] https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6 Signed-off-by: Yogita Urade --- meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index e5ef7b34bf..33fd1d8872 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -70,6 +70,7 @@ RDEPENDS:${PN}-ptest += " \ " CVE_PRODUCT = "pillow" +CVE_STATUS[CVE-2026-55798] = "not-applicable-platform: The CVE affects WindowsViewer/cmd.exe; the Linux target uses UnixViewer" RPROVIDES:${PN} += "python3-imaging"