* Re: [Buildroot] [PATCH] package/python-pillow: security bump to version 13.0.0
2026-10-30 11:42 [Buildroot] [PATCH] package/python-pillow: security bump to version 13.0.0 Angelo Compagnucci
@ 2026-10-31 10:07 ` Julien Olivain via buildroot
2026-10-31 14:35 ` [Buildroot] [PATCH v2] " Angelo Compagnucci
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-10-31 10:07 UTC (permalink / raw)
To: Angelo Compagnucci; +Cc: buildroot
Hi Angelo,
Thanks for the patch.
On 30/10/2026 12:42, Angelo Compagnucci wrote:
> Fixes the following security issues:
>
> - CVE-2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage
> reused
> after mode transitions
> - GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer
> overflow
> from scanlines wider than tile extents
> - CVE-2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read
> from dimension truncation
> - CVE-2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass
> via seek()
> - CVE-2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header
> replacement
> loop
> - CVE-2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC
> profile fills encoder buffer
> - GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr
> decoding
> out-of-bounds read from undersized libtiff buffers
> - GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer
> chains and deep or cyclic page trees
> - CVE-2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion
> from repeated page tree references
> - GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized
> Colormap for non-8-bit images
> - GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to
> a file object
> - GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags
> override the image size
> - GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from
> mismatched tag values
> - GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for
> short JPEG strips
> - GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when
> reading tile-part data
> - GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write
> - CVE-2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression
> bomb bypass via seek()
> - GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids
> reference
> - GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed
> disposal-frame sizing
> - CVE-2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes
> infinite CPU-spin loop
> - CVE-2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder
> memory-amplification denial of service
> - GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into
> unbounded memory
> - GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU
> amplification from shared tag data
> - GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a
> PDF
> - GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested
> objects
> - GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target
> palette
> - GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of
> service
> - GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF
> comment handling quadratic-time blowup from repeated concatenation
> - GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for
> zero-dimension images
> - CVE-2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont
> text
> width calculation
> - GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging
> 32-bit
> images as narrower bands
> - GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font
> rendering error path
> - GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an
> allocation failure
> - GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the
> end
> of their input
> - GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript
> - GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size
> discarded on failure
> - GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript
> rendering
> - GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write
> on
> zero-width images
>
> Fix the AVIF build option: Pillow names it avif, the -Clibavif setting
> was silently ignored, so AVIF support was only auto-detected instead of
> following BR2_PACKAGE_LIBAVIF.
>
> Release notes:
> https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html
>
> Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
> ---
> package/python-pillow/python-pillow.hash | 4 ++--
> package/python-pillow/python-pillow.mk | 8 ++++----
> 2 files changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/package/python-pillow/python-pillow.hash
> b/package/python-pillow/python-pillow.hash
> index 6f9c5d2cb1..2bc0206258 100644
> --- a/package/python-pillow/python-pillow.hash
> +++ b/package/python-pillow/python-pillow.hash
> @@ -1,5 +1,5 @@
> # md5, sha256 from https://pypi.org/pypi/pillow/json
> -md5 c714771477fa686ba789092cf84234c7 pillow-12.3.0.tar.gz
> -sha256
> 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce
> pillow-12.3.0.tar.gz
> +md5 c774e5aef5897704ccd528d0781a9b37 pillow-13.0.0.tar.gz
> +sha256
> cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510
> pillow-13.0.0.tar.gz
> # Locally computed sha256 checksums
> sha256
> 15181e7363dca9aed78b79bebebc7fde7f1814b8bd311ea3b87ae8ccadfc185b
> LICENSE
> diff --git a/package/python-pillow/python-pillow.mk
> b/package/python-pillow/python-pillow.mk
> index 433cbae5e5..240353eda3 100644
> --- a/package/python-pillow/python-pillow.mk
> +++ b/package/python-pillow/python-pillow.mk
> @@ -4,8 +4,8 @@
> #
>
> ################################################################################
>
> -PYTHON_PILLOW_VERSION = 12.3.0
> -PYTHON_PILLOW_SITE =
> https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9
> +PYTHON_PILLOW_VERSION = 13.0.0
> +PYTHON_PILLOW_SITE =
> https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d
Trying to build this new version with commands:
cat >.config <<EOF
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PYTHON3=y
BR2_PYTHON_PILLOW=y
EOF
make olddefconfig
make python-pillow
fails with the error:
aarch64-none-linux-gnu-gcc: ERROR: unsafe header/library path used in
cross-compilation: '-I/usr/include'
Could you have a look, please?
> PYTHON_PILLOW_SOURCE = pillow-$(PYTHON_PILLOW_VERSION).tar.gz
> PYTHON_PILLOW_LICENSE = MIT-CMU
> PYTHON_PILLOW_LICENSE_FILES = LICENSE
> @@ -43,9 +43,9 @@ endif
>
> ifeq ($(BR2_PACKAGE_LIBAVIF),y)
> PYTHON_PILLOW_DEPENDENCIES += libavif
> -PYTHON_PILLOW_BUILD_OPTS += -Clibavif=enable
> +PYTHON_PILLOW_BUILD_OPTS += -Cavif=enable
> else
> -PYTHON_PILLOW_BUILD_OPTS += -Clibavif=disable
> +PYTHON_PILLOW_BUILD_OPTS += -Cavif=disable
> endif
>
> ifeq ($(BR2_PACKAGE_LIBXCB),y)
> --
> 2.34.1
Best regards,
Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* [Buildroot] [PATCH v2] package/python-pillow: security bump to version 13.0.0
2026-10-30 11:42 [Buildroot] [PATCH] package/python-pillow: security bump to version 13.0.0 Angelo Compagnucci
2026-10-31 10:07 ` Julien Olivain via buildroot
@ 2026-10-31 14:35 ` Angelo Compagnucci
1 sibling, 0 replies; 3+ messages in thread
From: Angelo Compagnucci @ 2026-10-31 14:35 UTC (permalink / raw)
To: buildroot; +Cc: Angelo Compagnucci
Fixes the following security issues:
- CVE-2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage reused
after mode transitions
- GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer overflow
from scanlines wider than tile extents
- CVE-2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read
from dimension truncation
- CVE-2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass
via seek()
- CVE-2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header replacement
loop
- CVE-2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC
profile fills encoder buffer
- GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr decoding
out-of-bounds read from undersized libtiff buffers
- GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer
chains and deep or cyclic page trees
- CVE-2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion
from repeated page tree references
- GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized
Colormap for non-8-bit images
- GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to
a file object
- GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags
override the image size
- GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from
mismatched tag values
- GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for
short JPEG strips
- GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when
reading tile-part data
- GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write
- CVE-2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression
bomb bypass via seek()
- GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids
reference
- GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed
disposal-frame sizing
- CVE-2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes
infinite CPU-spin loop
- CVE-2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder
memory-amplification denial of service
- GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into
unbounded memory
- GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU
amplification from shared tag data
- GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a PDF
- GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested
objects
- GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target
palette
- GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of
service
- GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF
comment handling quadratic-time blowup from repeated concatenation
- GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for
zero-dimension images
- CVE-2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont text
width calculation
- GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging 32-bit
images as narrower bands
- GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font
rendering error path
- GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an
allocation failure
- GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the end
of their input
- GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript
- GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size
discarded on failure
- GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript
rendering
- GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write on
zero-width images
Fix the AVIF build option: Pillow names it avif, the -Clibavif setting
was silently ignored, so AVIF support was only auto-detected instead of
following BR2_PACKAGE_LIBAVIF.
Pillow 13.0.0 adds the Python installation include and library
directories from sysconfig, which are /usr/include and /usr/lib when
cross-compiling, so the build fails with:
ERROR: unsafe header/library path used in cross-compilation: '-I/usr/include'
Add a patch, backported from an upstream pull request, skipping those
directories when building against an uninstalled Python, as done by
Buildroot.
Release notes:
https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
---
Changes v1 -> v2:
- add a patch fixing the "unsafe header/library path" build failure
[Julien]
---
...allation-paths-for-build-tree-Python.patch | 48 +++++++++++++++++++
package/python-pillow/python-pillow.hash | 4 +-
package/python-pillow/python-pillow.mk | 8 ++--
3 files changed, 54 insertions(+), 6 deletions(-)
create mode 100644 package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch
diff --git a/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch b/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch
new file mode 100644
index 0000000000..ecbff40e2f
--- /dev/null
+++ b/package/python-pillow/0001-Skip-Python-installation-paths-for-build-tree-Python.patch
@@ -0,0 +1,48 @@
+From d32fb4da510c91ba3596fad8d3d73074b1b287ac Mon Sep 17 00:00:00 2001
+From: James Hilliard <james.hilliard1@gmail.com>
+Date: Sun, 18 Oct 2026 12:37:23 -0600
+Subject: [PATCH] Skip Python installation paths for build-tree Python
+
+Upstream: https://github.com/python-pillow/Pillow/pull/10236
+[Angelo: drop the docs/releasenotes/13.1.0.rst change, the file is not
+in the 13.0.0 release]
+Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
+---
+ setup.py | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/setup.py b/setup.py
+index 2d02cf129ca..7de22bb78eb 100644
+--- a/setup.py
++++ b/setup.py
+@@ -572,16 +572,20 @@ def build_extensions(self) -> None:
+ for d in os.environ[k].split(os.path.pathsep):
+ _add_directory(library_dirs, d)
+
+- _add_directory(
+- library_dirs,
+- (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
+- or os.path.join(sys.prefix, "lib"),
+- )
+- _add_directory(
+- include_dirs,
+- (sys.prefix == sys.base_prefix and sysconfig.get_config_var("INCLUDEDIR"))
+- or os.path.join(sys.prefix, "include"),
+- )
++ if not sysconfig.is_python_build():
++ _add_directory(
++ library_dirs,
++ (sys.prefix == sys.base_prefix and sysconfig.get_config_var("LIBDIR"))
++ or os.path.join(sys.prefix, "lib"),
++ )
++ _add_directory(
++ include_dirs,
++ (
++ sys.prefix == sys.base_prefix
++ and sysconfig.get_config_var("INCLUDEDIR")
++ )
++ or os.path.join(sys.prefix, "include"),
++ )
+
+ #
+ # add platform directories
diff --git a/package/python-pillow/python-pillow.hash b/package/python-pillow/python-pillow.hash
index 6f9c5d2cb1..2bc0206258 100644
--- a/package/python-pillow/python-pillow.hash
+++ b/package/python-pillow/python-pillow.hash
@@ -1,5 +1,5 @@
# md5, sha256 from https://pypi.org/pypi/pillow/json
-md5 c714771477fa686ba789092cf84234c7 pillow-12.3.0.tar.gz
-sha256 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce pillow-12.3.0.tar.gz
+md5 c774e5aef5897704ccd528d0781a9b37 pillow-13.0.0.tar.gz
+sha256 cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510 pillow-13.0.0.tar.gz
# Locally computed sha256 checksums
sha256 15181e7363dca9aed78b79bebebc7fde7f1814b8bd311ea3b87ae8ccadfc185b LICENSE
diff --git a/package/python-pillow/python-pillow.mk b/package/python-pillow/python-pillow.mk
index 433cbae5e5..240353eda3 100644
--- a/package/python-pillow/python-pillow.mk
+++ b/package/python-pillow/python-pillow.mk
@@ -4,8 +4,8 @@
#
################################################################################
-PYTHON_PILLOW_VERSION = 12.3.0
-PYTHON_PILLOW_SITE = https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9
+PYTHON_PILLOW_VERSION = 13.0.0
+PYTHON_PILLOW_SITE = https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d
PYTHON_PILLOW_SOURCE = pillow-$(PYTHON_PILLOW_VERSION).tar.gz
PYTHON_PILLOW_LICENSE = MIT-CMU
PYTHON_PILLOW_LICENSE_FILES = LICENSE
@@ -43,9 +43,9 @@ endif
ifeq ($(BR2_PACKAGE_LIBAVIF),y)
PYTHON_PILLOW_DEPENDENCIES += libavif
-PYTHON_PILLOW_BUILD_OPTS += -Clibavif=enable
+PYTHON_PILLOW_BUILD_OPTS += -Cavif=enable
else
-PYTHON_PILLOW_BUILD_OPTS += -Clibavif=disable
+PYTHON_PILLOW_BUILD_OPTS += -Cavif=disable
endif
ifeq ($(BR2_PACKAGE_LIBXCB),y)
--
2.34.1
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread