[Git][security-tracker-team/security-tracker][master] Add mroe pillow issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
096a865e by Salvatore Bonaccorso at 2026-10-20T10:49:33+02:00
Add mroe pillow issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -195,15 +195,26 @@ CVE-2026-112896 (Pillow is a Python imaging library. Prior to 13.0.0, Pillow's T
 	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p
 	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742 (13.0.0)
 CVE-2026-112895 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow ca ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf (13.0.0)
+	NOTE: CVE exists because of an incomplete fix for CVE-2026-42310.
 CVE-2026-112894 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow ta ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb (13.0.0)
 CVE-2026-112893 (Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow c ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13 (13.0.0)
 CVE-2026-112892 (Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's  ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3 (13.0.0)
 CVE-2026-112891 (Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow pe ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e (13.0.0)
 CVE-2026-112782 (Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a res ...)
 	TODO: check
 CVE-2026-112781 (Grav from 2.0.0 before 2.2.2 contains an information disclosure vulner ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/096a865e52d390bf807c5c4d62fd2040233dee1a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/096a865e52d390bf807c5c4d62fd2040233dee1a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/fb6b9712/attachment.htm>