Re: [Buildroot] [PATCH] package/python-pillow: security bump to version 13.0.0

[Julien Olivain via buildroot <buildroot@buildroot.org>]

Hi Angelo,

Thanks for the patch.

On 30/10/2026 12:42, Angelo Compagnucci wrote:
> Fixes the following security issues:
> 
> - CVE-2026-96639, GHSA-v9pv-5gc8-w2m6: Stale native image storage 
> reused
>   after mode transitions
> - GHSA-5x8w-8jj5-q52h, GHSA-8g5g-8vmr-9782: JPEG decoder buffer 
> overflow
>   from scanlines wider than tile extents
> - CVE-2026-96644, GHSA-9v9v-9qvf-h2hj: WMF/EMF heap out-of-bounds read
>   from dimension truncation
> - CVE-2026-96637, GHSA-g842-9rc4-69pw: SPIDER decompression bomb bypass
>   via seek()
> - CVE-2026-96643, GHSA-g4qv-2jxx-769h: Unbounded Exif header 
> replacement
>   loop
> - CVE-2026-96778, GHSA-g7cr-3p24-7wf7: JPEG comment write after ICC
>   profile fills encoder buffer
> - GHSA-462x-pgg6-55fp, GHSA-c6hw-5grf-ff96: TIFF tile and YCbCr 
> decoding
>   out-of-bounds read from undersized libtiff buffers
> - GHSA-p4wg-p73j-c528: PDF parsing stack exhaustion from long trailer
>   chains and deep or cyclic page trees
> - CVE-2026-96640, GHSA-mrfp-p49p-3hf2: PDF append resource exhaustion
>   from repeated page tree references
> - GHSA-pchr-8j38-3x4p: TIFF encoder accepted an incorrectly sized
>   Colormap for non-8-bit images
> - GHSA-332p-7hrc-92wf: TIFF encoder heap buffer overflow when saving to
>   a file object
> - GHSA-xcvg-w56q-r89m: TIFF encoder heap buffer overflow when tags
>   override the image size
> - GHSA-xvh5-g6gv-559v: TIFF encoder memory disclosure and crash from
>   mismatched tag values
> - GHSA-q45j-58j2-45rg: TIFF decoding returned uninitialized memory for
>   short JPEG strips
> - GHSA-78g4-xqwv-q3g8: Bundled OpenJPEG heap buffer overflow when
>   reading tile-part data
> - GHSA-4rr5-89j8-mwwm: TIFF encoder use-after-free write
> - CVE-2026-96636, GHSA-p8hx-v2p6-rp84: MPO, DCX and MIC decompression
>   bomb bypass via seek()
> - GHSA-f2g6-542v-9j58: PDF page tree stack exhaustion via cyclic /Kids
>   reference
> - GHSA-5xm2-6676-qcp9: APNG decompression bomb bypass via delayed
>   disposal-frame sizing
> - CVE-2026-96642, GHSA-3j72-p6qg-6xp7: TarIO negative size field causes
>   infinite CPU-spin loop
> - CVE-2026-96638, GHSA-24rc-8hj2-v98c: BMP RLE decoder
>   memory-amplification denial of service
> - GHSA-gg2r-wvfm-q9rx: MSP RLE decoder expands a tiny file into
>   unbounded memory
> - GHSA-wqgw-9xfh-qf2g: TIFF and Exif IFD parsing memory and CPU
>   amplification from shared tag data
> - GHSA-jg86-v3jv-hrpm: Quadratic time when writing many objects to a 
> PDF
> - GHSA-254f-3936-288h: PdfParser unbounded recursion via deeply nested
>   objects
> - GHSA-rfgq-q3w2-pmv2: Image.quantize() crash from an empty target
>   palette
> - GHSA-xgh8-jp6q-p5x8: XBM header parsing regular expression denial of
>   service
> - GHSA-22hg-r758-rrw9, GHSA-74r2-7ff9-mjj2, GHSA-fc9g-5qg7-mf45: GIF
>   comment handling quadratic-time blowup from repeated concatenation
> - GHSA-27h8-gf7j-v5hc: Out-of-bounds read in rank-based filters for
>   zero-dimension images
> - CVE-2026-96641, GHSA-4rm8-3hmm-39fg: Integer underflow in PILfont 
> text
>   width calculation
> - GHSA-cp9v-662q-vvx9: Image.merge() buffer overflow when merging 
> 32-bit
>   images as narrower bands
> - GHSA-j4m9-6w36-pw47: Uninitialized glyph pointer freed on font
>   rendering error path
> - GHSA-7mwm-ghpf-9vrm: Double free in Image.transform() after an
>   allocation failure
> - GHSA-4558-3h8r-v8xp: P;2L and P;4L raw mode decoders read past the 
> end
>   of their input
> - GHSA-w889-685w-c8fh: EPS filename argument injection into Ghostscript
> - GHSA-65qm-jvmh-6pqg: GIF decompression bomb check used a size
>   discarded on failure
> - GHSA-vx6w-vv9f-6gvg: EPS decompression bomb bypass via Ghostscript
>   rendering
> - GHSA-58r4-6rv3-gfh8: ImageMorph.MorphOp.apply() out-of-bounds write 
> on
>   zero-width images
> 
> Fix the AVIF build option: Pillow names it avif, the -Clibavif setting
> was silently ignored, so AVIF support was only auto-detected instead of
> following BR2_PACKAGE_LIBAVIF.
> 
> Release notes:
> https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html
> 
> Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
> ---
>  package/python-pillow/python-pillow.hash | 4 ++--
>  package/python-pillow/python-pillow.mk   | 8 ++++----
>  2 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/package/python-pillow/python-pillow.hash 
> b/package/python-pillow/python-pillow.hash
> index 6f9c5d2cb1..2bc0206258 100644
> --- a/package/python-pillow/python-pillow.hash
> +++ b/package/python-pillow/python-pillow.hash
> @@ -1,5 +1,5 @@
>  # md5, sha256 from https://pypi.org/pypi/pillow/json
> -md5  c714771477fa686ba789092cf84234c7  pillow-12.3.0.tar.gz
> -sha256  
> 3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce  
> pillow-12.3.0.tar.gz
> +md5  c774e5aef5897704ccd528d0781a9b37  pillow-13.0.0.tar.gz
> +sha256  
> cdcd1ba258178f7356d74170c9a81ba4eab6a5d55748bc402a5a2a6fe6be3510  
> pillow-13.0.0.tar.gz
>  # Locally computed sha256 checksums
>  sha256  
> 15181e7363dca9aed78b79bebebc7fde7f1814b8bd311ea3b87ae8ccadfc185b  
> LICENSE
> diff --git a/package/python-pillow/python-pillow.mk 
> b/package/python-pillow/python-pillow.mk
> index 433cbae5e5..240353eda3 100644
> --- a/package/python-pillow/python-pillow.mk
> +++ b/package/python-pillow/python-pillow.mk
> @@ -4,8 +4,8 @@
>  #
>  
> ################################################################################
> 
> -PYTHON_PILLOW_VERSION = 12.3.0
> -PYTHON_PILLOW_SITE = 
> https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9
> +PYTHON_PILLOW_VERSION = 13.0.0
> +PYTHON_PILLOW_SITE = 
> https://files.pythonhosted.org/packages/ce/a4/9cc30690a394a8305e8be4c9036aa16d0dfddadd09079860b582f562496d

Trying to build this new version with commands:

cat >.config <<EOF
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PYTHON3=y
BR2_PYTHON_PILLOW=y
EOF
make olddefconfig
make python-pillow

fails with the error:

aarch64-none-linux-gnu-gcc: ERROR: unsafe header/library path used in 
cross-compilation: '-I/usr/include'

Could you have a look, please?

>  PYTHON_PILLOW_SOURCE = pillow-$(PYTHON_PILLOW_VERSION).tar.gz
>  PYTHON_PILLOW_LICENSE = MIT-CMU
>  PYTHON_PILLOW_LICENSE_FILES = LICENSE
> @@ -43,9 +43,9 @@ endif
> 
>  ifeq ($(BR2_PACKAGE_LIBAVIF),y)
>  PYTHON_PILLOW_DEPENDENCIES += libavif
> -PYTHON_PILLOW_BUILD_OPTS += -Clibavif=enable
> +PYTHON_PILLOW_BUILD_OPTS += -Cavif=enable
>  else
> -PYTHON_PILLOW_BUILD_OPTS += -Clibavif=disable
> +PYTHON_PILLOW_BUILD_OPTS += -Cavif=disable
>  endif
> 
>  ifeq ($(BR2_PACKAGE_LIBXCB),y)
> --
> 2.34.1

Best regards,

Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot