ELSA-2026-93077

ELSA-2026-93077 - python-pillow security update

Type:	SECURITY
Impact:	CRITICAL
Release Date:	2026-11-02

Description

[5.1.1-36]
- CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript
call, potentially leading into RCE
Resolves: RHEL-295960

[5.1.1-35]
- CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix
(FPX) JPEG decoding leads to code execution
Resolves: RHEL-294549

[5.1.1-34]
- CVE-2026-112393 python-pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Resolves: RHEL-293597

Related CVEs

CVE-2026-112393

CVE-2026-112398

CVE-2026-112900

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	python-pillow-5.1.1-36.el8_10.src.rpm	de9a33c7bcf1ef8e03b42851cd76bce0f3b3745e1433da843a73a16e0fc66e13	-	ol8_aarch64_appstream
	python-pillow-5.1.1-36.el8_10.src.rpm	de9a33c7bcf1ef8e03b42851cd76bce0f3b3745e1433da843a73a16e0fc66e13	-	ol8_aarch64_codeready_builder
	python3-pillow-5.1.1-36.el8_10.aarch64.rpm	fe4d2868d5cafb74ad2382c74a86b9aebe846b2faa9e2eb5e5959651d627534a	-	ol8_aarch64_appstream
	python3-pillow-devel-5.1.1-36.el8_10.aarch64.rpm	f8c9ef5ea5c28f44cb06356f96ce9fdad631d3e1b5b257d65d704048bd79d261	-	ol8_aarch64_codeready_builder
	python3-pillow-doc-5.1.1-36.el8_10.noarch.rpm	58501b0abe0b6447ab4f218896ea5dd6577715b24d415231a0f9ddeffbb8e2e1	-	ol8_aarch64_codeready_builder
	python3-pillow-tk-5.1.1-36.el8_10.aarch64.rpm	a374f5396dbffe63aec0902e9a0d5cc09ad45fdd909b10396d32e34aae3b175d	-	ol8_aarch64_codeready_builder
Oracle Linux 8 (x86_64)	python-pillow-5.1.1-36.el8_10.src.rpm	de9a33c7bcf1ef8e03b42851cd76bce0f3b3745e1433da843a73a16e0fc66e13	-	ol8_x86_64_appstream
	python-pillow-5.1.1-36.el8_10.src.rpm	de9a33c7bcf1ef8e03b42851cd76bce0f3b3745e1433da843a73a16e0fc66e13	-	ol8_x86_64_codeready_builder
	python3-pillow-5.1.1-36.el8_10.i686.rpm	fbd7c178a563f8eaa653f5982bd812e7a2231ff570871845dbfbd0445f4cc9eb	-	ol8_x86_64_codeready_builder
	python3-pillow-5.1.1-36.el8_10.x86_64.rpm	1913d4764481816b8bece01595bb701f3c17d663195220bc9c62b2ff5f4f7ef3	-	ol8_x86_64_appstream
	python3-pillow-devel-5.1.1-36.el8_10.i686.rpm	e1169c089ccefc1932a7a12f0e79c100e72a5e733e466219acd902f9728651a2	-	ol8_x86_64_codeready_builder
	python3-pillow-devel-5.1.1-36.el8_10.x86_64.rpm	ba7c067e6ff3c049368e524e30343ddbdc8d1d9199cf073d4bf910162c8eeca9	-	ol8_x86_64_codeready_builder
	python3-pillow-doc-5.1.1-36.el8_10.noarch.rpm	58501b0abe0b6447ab4f218896ea5dd6577715b24d415231a0f9ddeffbb8e2e1	-	ol8_x86_64_codeready_builder
	python3-pillow-tk-5.1.1-36.el8_10.x86_64.rpm	152643aea835ec8963f159e1be0530b6a54f36450dc83cc94ac70dd66988bdf2	-	ol8_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team