Vulnerability · 1 source · latest 7h

Ubuntu notice USN-8999-1 fixes multiple Pillow image library vulnerabilities

VULNERABILITYUbunturedteam/daily · 1 source

Severity: Medium
Sources: 1

What happened

Ubuntu USN-8999-1 addresses Pillow flaws: CVE-2026-54058 (McIdas AREA map stride, information disclosure or DoS); CVE-2026-54059, CVE-2026-54060 and CVE-2026-55379 (missing decompression bomb checks in font handling, DoS); CVE-2026-55380 (GD decompression bomb, DoS); CVE-2026-59197 (rank filter size validation, crash or possible code execution); CVE-2026-59199 (coordinate calculation, crash); CVE-2026-59200 (unlimited decompressed PDF stream size, DoS); CVE-2026-59203 (EPS negative BeginBinary byte count, hang, Ubuntu 26.04 LTS only); CVE-2026-59204 (JPEG2000 tile component width accumulation, DoS); CVE-2026-59205 (colour management image mode validation, crash or possible code execution). The notice does not list affected or fixed Pillow versions, so defenders should check the USN for package versions and apply the update.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Apply the Pillow updates in Ubuntu security notice USN-8999-1.
Check whether systems or applications process untrusted images, fonts, EPS or PDF files with Pillow, as these are the affected formats.

Written by AI from the sources, checked against them

Read the full story at the source