[Git][security-tracker-team/security-tracker][master] Add new batch of pillow issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9e9d31fd by Salvatore Bonaccorso at 2026-10-22T10:10:51+02:00
Add new batch of pillow issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,25 +1,55 @@
 CVE-2026-97328 (The WebP Express WordPress plugin before 0.25.16 does not escape value ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96778 (Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJp ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7
+	NOTE: https://github.com/python-pillow/Pillow/pull/10124
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b (13.0.0)
 CVE-2026-96644 (Pillow is a Python imaging library. Prior to 13.0.0 on Windows, src/PI ...)
-	TODO: check
+	- pillow <not-affected> (Only affects Pillow builds on Windows)
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj
+	NOTE: https://github.com/python-pillow/Pillow/pull/10120
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7 (13.0.0)
 CVE-2026-96643 (Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.loa ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h
+	NOTE: https://github.com/python-pillow/Pillow/pull/10073
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c (13.0.0)
 CVE-2026-96642 (Pillow is a Python imaging library. Prior to 13.0.0, the TarIO initial ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7
+	NOTE: https://github.com/python-pillow/Pillow/pull/10012
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d (13.0.0)
 CVE-2026-96641 (Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-widt ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg
+	NOTE: https://github.com/python-pillow/Pillow/pull/10010
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4 (13.0.0)
 CVE-2026-96640 (Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2
+	NOTE: https://github.com/python-pillow/Pillow/pull/10093
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7 (13.0.0)
 CVE-2026-96639 (Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-fr ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6
+	NOTE: https://github.com/python-pillow/Pillow/pull/10105
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a (13.0.0)
 CVE-2026-96638 (Pillow is a Python imaging library. From 9.1.0 until 13.0.0, BmpRleDec ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c
+	NOTE: https://github.com/python-pillow/Pillow/pull/10015
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a (13.0.0)
 CVE-2026-96637 (Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.s ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw
+	NOTE: https://github.com/python-pillow/Pillow/pull/10076
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841 (13.0.0)
 CVE-2026-96636 (Pillow is a Python imaging library. Prior to 13.0.0, MpoImageFile.seek ...)
-	TODO: check
+	- pillow 13.0.0-1
+	NOTE: https://github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84
+	NOTE: https://github.com/python-pillow/Pillow/pull/10011
+	NOTE: Fixed by: https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48 (13.0.0)
 CVE-2026-96398 (Incorrect Authorization vulnerability in Drupal Webform allows Forcefu ...)
 	NOT-FOR-US: Drupal core and addons
 CVE-2026-96392 (Improper Neutralization of Special Elements Used in a Template Engine  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e9d31fdfc8a05d9fb13ee9a3dd5a65bd5487ac8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e9d31fdfc8a05d9fb13ee9a3dd5a65bd5487ac8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261022/ffb38f39/attachment-0001.htm>