[Git][security-tracker-team/security-tracker][master] Add another batch of pillow issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
174e350a by Salvatore Bonaccorso at 2026-10-20T11:33:03+02:00
Add another batch of pillow issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -246,19 +246,34 @@ CVE-2026-112769 (Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does
 CVE-2026-112768 (Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates c ...)
 	NOT-FOR-US: Parse Server
 CVE-2026-112406 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow ca ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777 (13.0.0)
 CVE-2026-112405 (Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's ...)
-	TODO: check
+	- pillow <unfixed>
+	[trixie] - pillow <not-affected> (Vulnerable code not prsent)
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86 (13.0.0)
 CVE-2026-112404 (Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's  ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce (13.0.0)
 CVE-2026-112403 (Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75 (13.0.0)
 CVE-2026-112402 (Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9 (13.0.0)
 CVE-2026-112401 (Pillow is a Python imaging library. From 5.4.0 until 13.0.0, Pillow pe ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e (13.0.0)
 CVE-2026-112400 (Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow ca ...)
-	TODO: check
+	- pillow <unfixed>
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7 (13.0.0)
 CVE-2026-112399 (Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow ca ...)
 	TODO: check
 CVE-2026-112398 (Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/174e350a81aeff49dd15cec1a6b4a0a7f9d0c4a8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/174e350a81aeff49dd15cec1a6b4a0a7f9d0c4a8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261020/efcf9ddc/attachment-0001.htm>