SUSE-SU-2026:3268-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2026/suse-su-20263268-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:3268-1

Upstream

CVE (11)

Related

CVE (11)

Published

2026-07-27T10:59:25Z

Modified

2026-07-28T10:00:10Z

Summary

Security update for python-Pillow

Details

This update for python-Pillow fixes the following issues:

CVE-2026-54058: out-of-bounds read via attacker-controlled row stride on mmap path (bsc#1271419).
CVE-2026-54059: bomb protection bypass via PCF font loading due to Image.frombytes() being called without _decompression_bomb_check() (bsc#1270409).
CVE-2026-54060: excessive allocation due to FontFile.compile(): Image.new() being called without _decompression_bomb_check() (bsc#1270410).
CVE-2026-55379: bomb protection bypass via font loading due to Image.new() being called without _decompression_bomb_check() (bsc#1270411).
CVE-2026-55380: unchecked 4.3 GB C-heap allocation due to image dimensions being accepted without _decompression_bomb_check() in GdImageFile._open() (bsc#1270412).
CVE-2026-59197: heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand (bsc#1271418).
CVE-2026-59198: out-of-bounds heap data copied into file generated by TGA RLE encoder (bsc#1271420).
CVE-2026-59199: heap out-of-bounds write in Image.paste() and Image.crop() via signed coordinate overflow (bsc#1271421).
CVE-2026-59200: decompression bomb DoS via PdfParser.PdfStream.decode() (bsc#1271422).
CVE-2026-59204: denial of service through memory exhaustion via JPEG2000 tiled decoder (bsc#1271424).
CVE-2026-59205: controlled heap out-of-bounds write in ImageCmsTransform.apply() via output mode mismatch (bsc#1271425).

References

Affected packages

SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Module for Python 3 15 SP7

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Python%203%2015%20SP7

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server 15 SP4-LTSS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server 15 SP5-LTSS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server 15 SP6-LTSS

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP4

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP5

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"

SUSE:Linux Enterprise Server for SAP Applications 15 SP6

python-Pillow

Package

Name: python-Pillow
Purl: pkg:rpm/suse/python-Pillow&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

9.5.0-150400.5.25.1

Ecosystem specific

{
    "binaries":  [
        {
            "python311-Pillow":  "9.5.0-150400.5.25.1",
            "python311-Pillow-tk":  "9.5.0-150400.5.25.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3268-1.json"