guix_mirror_bot pushed a commit to branch python-team
in repository guix.
commit 149534a89cd7bea382195ace7c2db67abab930fa
Author: Hugo Buddelmeijer <[email protected]>
AuthorDate: Fri Oct 23 12:14:18 2026 +0200
gnu: python-pillow: Update to 13.0.0. [security-fixes]
Security vulnerabilities fixed:
CVE 2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage reused
after mode transitions
GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer overflow from
scanlines wider than tile extents
CVE 2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read from
dimension truncation
CVE 2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass via
seek()
CVE 2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header replacement loop
CVE 2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC profile
fills
encoder buffer
GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr
decoding out-of-bounds read from undersized libtiff buffers
GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer chains
and
deep or cyclic page trees
CVE 2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion from
repeated page tree references
GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized Colormap for
non-8-bit images
GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to a file
object
GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags override
the
image size
GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from
mismatched
tag values
GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for short
JPEG strips
GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when reading
tile-part data
GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write
CVE 2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression bomb
bypass via seek()
GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids
reference
GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed
disposal-frame
sizing
CVE 2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes
infinite
CPU-spin loop
CVE 2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder memory-amplification
denial of service
GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into unbounded
memory
GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU amplification
from shared tag data
GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a PDF
GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested objects
GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target palette
GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of service
GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF comment
handling quadratic-time blowup from repeated concatenation
GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for
zero-dimension images
CVE 2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont text width
calculation
GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging 32-bit
images
as narrower bands
GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font rendering
error
path
GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an allocation
failure
GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the end of
their input
GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript
GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size discarded on
failure
GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript rendering
GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write on
zero-width images
CVE 2026-59200: Prevent decompression bomb when parsing PDF
CVE 2026-55798: WindowsViewer.get_command injection
CVE 2026-59203: EPS image infinite loop
CVE 2026-59204: JPEG2000 image memory usage
CVE 2026-54058: McIdas out-of-bounds (OOB) read
CVE 2026-59198: Out-of-bounds (OOB) read when saving 1 mode TGA images
CVE 2026-59197: Out-of-bounds (OOB) write from large RankFilter sizes
CVE 2026-59199: Out-of-bounds (OOB) write from Image.paste()
CVE 2026-59205: Out-of-bounds (OOB) write in ImageCmsTransform
CVE 2026-54059, CVE 2026-54060, CVE 2026-55379: Prevent FontFile
decompression
bomb
CVE 2026-55380: Prevent GD decompression bomb
* gnu/packages/python-xyz.scm (python-pillow): Update to 13.0.0.
Merges: guix/guix!12052
Fixes: guix/guix#11995
Signed-off-by: Sharlatan Hellseher <[email protected]>
---
gnu/packages/python-xyz.scm | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/gnu/packages/python-xyz.scm b/gnu/packages/python-xyz.scm
index 7b6130a9034..53d38f45dc8 100644
--- a/gnu/packages/python-xyz.scm
+++ b/gnu/packages/python-xyz.scm
@@ -14417,7 +14417,7 @@ Python list with elements of type @code{PIL.Image}
(from the
(define-public python-pillow
(package
(name "python-pillow")
- (version "12.2.0")
+ (version "13.0.0")
(source
(origin
(method git-fetch)
@@ -14426,7 +14426,7 @@ Python list with elements of type @code{PIL.Image}
(from the
(commit version)))
(file-name (git-file-name name version))
(sha256
- (base32 "140ynzxpazq6gq041bhkzx314z4kkzv3wlmvph68a0nkj9nqa3pg"))))
+ (base32 "1vlkl35hh60i5j72lqil4484wngw9mb29p3b3si4mqyk0yzg0lgc"))))
(build-system pyproject-build-system)
(arguments
(list
@@ -14467,7 +14467,7 @@ stored in a few basic pixel formats. It should provide
a solid foundation for
a general image processing tool.")
(properties `((cpe-name . "pillow")))
(license (license:x11-style
- "https://github.com/python-pillow/Pillow/blob/12.2.0/LICENSE";
+ "https://github.com/python-pillow/Pillow/blob/13.0.0/LICENSE";
"MIT-CMU License"))))
(define-public python-pillow-avif-plugin
