OPENSUSE-SU-2026:12230-1
Vulnerability from csaf_opensuse - Published: 2026-10-22 00:00 - Updated: 2026-10-23 09:44Summary
python313-Pillow-13.0.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: python313-Pillow-13.0.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the python313-Pillow-13.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12230
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
8.2 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
8.1 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
8.1 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
moderate
8.2 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
8.2 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
moderate
9.8 (Critical)
Affected products
Recommended
16 products, the same list as for
CVE-2026-112390
Threats
Impact
critical
References
44 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "python313-Pillow-13.0.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the python313-Pillow-13.0.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-12230",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12230-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112390 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112390/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112392 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112392/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112394 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112394/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112396 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112396/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112398 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112398/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112400 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112400/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112402 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112404 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112404/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112406 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112406/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112892 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112892/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112894 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112894/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112896 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112896/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112898 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112898/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-112900 page",
"url": "https://www.suse.com/security/cve/CVE-2026-112900/"
}
],
"title": "python313-Pillow-13.0.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-10-23T09:44:50Z",
"generator": {
"date": "2026-10-22T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:12230-1",
"initial_release_date": "2026-10-22T00:00:00Z",
"revision_history": [
{
"date": "2026-10-22T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-10-23T09:44:50Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python313-Pillow-0:13.0.0-1.1.aarch64",
"product": {
"name": "python313-Pillow-0:13.0.0-1.1.aarch64",
"product_id": "python313-Pillow-0:13.0.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow@13.0.0-1.1?arch=aarch64\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"product": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"product_id": "python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow-tk@13.0.0-1.1?arch=aarch64\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-0:13.0.0-1.1.aarch64",
"product": {
"name": "python314-Pillow-0:13.0.0-1.1.aarch64",
"product_id": "python314-Pillow-0:13.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow@13.0.0-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"product": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"product_id": "python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow-tk@13.0.0-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "python313-Pillow-0:13.0.0-1.1.ppc64le",
"product": {
"name": "python313-Pillow-0:13.0.0-1.1.ppc64le",
"product_id": "python313-Pillow-0:13.0.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow@13.0.0-1.1?arch=ppc64le\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product_id": "python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow-tk@13.0.0-1.1?arch=ppc64le\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-0:13.0.0-1.1.ppc64le",
"product": {
"name": "python314-Pillow-0:13.0.0-1.1.ppc64le",
"product_id": "python314-Pillow-0:13.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow@13.0.0-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product_id": "python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow-tk@13.0.0-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "python313-Pillow-0:13.0.0-1.1.s390x",
"product": {
"name": "python313-Pillow-0:13.0.0-1.1.s390x",
"product_id": "python313-Pillow-0:13.0.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow@13.0.0-1.1?arch=s390x\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python313-Pillow-tk-0:13.0.0-1.1.s390x",
"product": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.s390x",
"product_id": "python313-Pillow-tk-0:13.0.0-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow-tk@13.0.0-1.1?arch=s390x\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-0:13.0.0-1.1.s390x",
"product": {
"name": "python314-Pillow-0:13.0.0-1.1.s390x",
"product_id": "python314-Pillow-0:13.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow@13.0.0-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-tk-0:13.0.0-1.1.s390x",
"product": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.s390x",
"product_id": "python314-Pillow-tk-0:13.0.0-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow-tk@13.0.0-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "python313-Pillow-0:13.0.0-1.1.x86_64",
"product": {
"name": "python313-Pillow-0:13.0.0-1.1.x86_64",
"product_id": "python313-Pillow-0:13.0.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow@13.0.0-1.1?arch=x86_64\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"product": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"product_id": "python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:python:pillow:13.0.0:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/python313-Pillow-tk@13.0.0-1.1?arch=x86_64\u0026upstream=python-Pillow-0:13.0.0-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-0:13.0.0-1.1.x86_64",
"product": {
"name": "python314-Pillow-0:13.0.0-1.1.x86_64",
"product_id": "python314-Pillow-0:13.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow@13.0.0-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "python314-Pillow-tk-0:13.0.0-1.1.x86_64",
"product": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.x86_64",
"product_id": "python314-Pillow-tk-0:13.0.0-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/python314-Pillow-tk@13.0.0-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-0:13.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64"
},
"product_reference": "python313-Pillow-0:13.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-0:13.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le"
},
"product_reference": "python313-Pillow-0:13.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-0:13.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x"
},
"product_reference": "python313-Pillow-0:13.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-0:13.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64"
},
"product_reference": "python313-Pillow-0:13.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64"
},
"product_reference": "python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le"
},
"product_reference": "python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x"
},
"product_reference": "python313-Pillow-tk-0:13.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python313-Pillow-tk-0:13.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64"
},
"product_reference": "python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-0:13.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64"
},
"product_reference": "python314-Pillow-0:13.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-0:13.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le"
},
"product_reference": "python314-Pillow-0:13.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-0:13.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x"
},
"product_reference": "python314-Pillow-0:13.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-0:13.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64"
},
"product_reference": "python314-Pillow-0:13.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64"
},
"product_reference": "python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le"
},
"product_reference": "python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x"
},
"product_reference": "python314-Pillow-tk-0:13.0.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python314-Pillow-tk-0:13.0.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
},
"product_reference": "python314-Pillow-tk-0:13.0.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-112390",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112390"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() resets TIFF frame state, so an embedded TIFF with at least three IFDs never advances. When an application with olefile installed reads n_frames or saves all frames from a crafted MIC file, the non-advancing traversal can hold a worker at full CPU indefinitely. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112390",
"url": "https://www.suse.com/security/cve/CVE-2026-112390"
},
{
"category": "external",
"summary": "SUSE Bug 1286256 for CVE-2026-112390",
"url": "https://bugzilla.suse.com/1286256"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112390"
},
{
"cve": "CVE-2026-112392",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112392"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter is never reached. An attacker can supply or cause creation of a zero-size image to an application that applies a rank, median, minimum, or maximum filter. This causes a native process crash. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112392",
"url": "https://www.suse.com/security/cve/CVE-2026-112392"
},
{
"category": "external",
"summary": "SUSE Bug 1286287 for CVE-2026-112392",
"url": "https://bugzilla.suse.com/1286287"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112392"
},
{
"cve": "CVE-2026-112394",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112394"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker\u0027s actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112394",
"url": "https://www.suse.com/security/cve/CVE-2026-112394"
},
{
"category": "external",
"summary": "SUSE Bug 1286311 for CVE-2026-112394",
"url": "https://bugzilla.suse.com/1286311"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112394"
},
{
"cve": "CVE-2026-112396",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112396"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIFF data to an in-memory buffer. When an application saves attacker-influenced TIFF tags to BytesIO, libtiff can reject a tag during encoding in ImagingLibTiffEncode; the error path then frees the output buffer without closing or clearing the TIFF handle, and later cleanup flushes through the write callback into freed memory, which can crash the process and may enable code execution. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112396",
"url": "https://www.suse.com/security/cve/CVE-2026-112396"
},
{
"category": "external",
"summary": "SUSE Bug 1286313 for CVE-2026-112396",
"url": "https://bugzilla.suse.com/1286313"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112396"
},
{
"cve": "CVE-2026-112398",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112398"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112398",
"url": "https://www.suse.com/security/cve/CVE-2026-112398"
},
{
"category": "external",
"summary": "SUSE Bug 1286406 for CVE-2026-112398",
"url": "https://bugzilla.suse.com/1286406"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112398"
},
{
"cve": "CVE-2026-112400",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112400"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an application catches that exception and continues processing the same image object, later seek or load operations allocate according to those dimensions and can exhaust memory, denying service. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112400",
"url": "https://www.suse.com/security/cve/CVE-2026-112400"
},
{
"category": "external",
"summary": "SUSE Bug 1286370 for CVE-2026-112400",
"url": "https://bugzilla.suse.com/1286370"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-112400"
},
{
"cve": "CVE-2026-112402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112402"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling. The output image allocation must succeed while the additional per-column lookup allocation fails, after which the error path deletes image storage that later cleanup releases again. An attacker who can drive such a large Image.transform() operation under memory pressure may trigger the failure. This can crash the process and may corrupt memory. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112402",
"url": "https://www.suse.com/security/cve/CVE-2026-112402"
},
{
"category": "external",
"summary": "SUSE Bug 1286381 for CVE-2026-112402",
"url": "https://bugzilla.suse.com/1286381"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-112402"
},
{
"cve": "CVE-2026-112404",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112404"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow\u0027s TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112404",
"url": "https://www.suse.com/security/cve/CVE-2026-112404"
},
{
"category": "external",
"summary": "SUSE Bug 1286388 for CVE-2026-112404",
"url": "https://bugzilla.suse.com/1286388"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112404"
},
{
"cve": "CVE-2026-112406",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112406"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to an application that appends an image to that PDF. This can hold the worker at full CPU and deny service. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112406",
"url": "https://www.suse.com/security/cve/CVE-2026-112406"
},
{
"category": "external",
"summary": "SUSE Bug 1286403 for CVE-2026-112406",
"url": "https://bugzilla.suse.com/1286403"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112406"
},
{
"cve": "CVE-2026-112892",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112892"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow\u0027s MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an application that loads its pixels. This can exhaust memory and deny service even when the declared pixel count passes the decompression-bomb check. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112892",
"url": "https://www.suse.com/security/cve/CVE-2026-112892"
},
{
"category": "external",
"summary": "SUSE Bug 1286401 for CVE-2026-112892",
"url": "https://bugzilla.suse.com/1286401"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112892"
},
{
"cve": "CVE-2026-112894",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112894"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can supply a multi-frame image, including a small APNG with a large declared frame count, to an application that converts it to a multipage PDF. This can consume excessive CPU and deny service. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112894",
"url": "https://www.suse.com/security/cve/CVE-2026-112894"
},
{
"category": "external",
"summary": "SUSE Bug 1286408 for CVE-2026-112894",
"url": "https://bugzilla.suse.com/1286408"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112894"
},
{
"cve": "CVE-2026-112896",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112896"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. Prior to 13.0.0, Pillow\u0027s TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap that is reused when the image is saved. An application that re-encodes the attacker\u0027s TIFF with libtiff can trigger the out-of-bounds read. This can disclose heap memory in the output or crash the process. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112896",
"url": "https://www.suse.com/security/cve/CVE-2026-112896"
},
{
"category": "external",
"summary": "SUSE Bug 1286400 for CVE-2026-112896",
"url": "https://bugzilla.suse.com/1286400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-112896"
},
{
"cve": "CVE-2026-112898",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112898"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palette has zero entries, and the conversion path emits those bytes as output pixel indices. An attacker who controls the palette image can obtain stack contents from a returned PNG or GIF. This can disclose addresses and stack-canary data without an out-of-bounds access, memory corruption, or process crash. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112898",
"url": "https://www.suse.com/security/cve/CVE-2026-112898"
},
{
"category": "external",
"summary": "SUSE Bug 1286399 for CVE-2026-112898",
"url": "https://bugzilla.suse.com/1286399"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-112898"
},
{
"cve": "CVE-2026-112900",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-112900"
}
],
"notes": [
{
"category": "general",
"text": "Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is vulnerable to argument injection when invoking Ghostscript for EPS input. EpsImagePlugin.Ghostscript passes a caller-controlled input filename after -f without converting it to a safe absolute path, so a name beginning with a hyphen can be interpreted as a Ghostscript option. An attacker who controls the filename can inject Ghostscript arguments. Arbitrary command execution specifically requires a leading @ argument-file filename and control of the referenced text file containing additional Ghostscript arguments; the reported chain reproduces with the default -dSAFER invocation. This issue is fixed in version 13.0.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-112900",
"url": "https://www.suse.com/security/cve/CVE-2026-112900"
},
{
"category": "external",
"summary": "SUSE Bug 1286397 for CVE-2026-112900",
"url": "https://bugzilla.suse.com/1286397"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python313-Pillow-tk-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-0:13.0.0-1.1.x86_64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.aarch64",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.ppc64le",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.s390x",
"openSUSE Tumbleweed:python314-Pillow-tk-0:13.0.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-10-22T00:00:00Z",
"details": "critical"
}
],
"title": "CVE-2026-112900"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.