[El-errata] ELSA-2026-92639 Important: Oracle Linux 8 python-pillow security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-92639

http://linux.oracle.com/errata/ELSA-2026-92639.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
python3-pillow-5.1.1-33.el8_10.i686.rpm
python3-pillow-5.1.1-33.el8_10.x86_64.rpm
python3-pillow-devel-5.1.1-33.el8_10.i686.rpm
python3-pillow-devel-5.1.1-33.el8_10.x86_64.rpm
python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm
python3-pillow-tk-5.1.1-33.el8_10.x86_64.rpm

aarch64:
python3-pillow-5.1.1-33.el8_10.aarch64.rpm
python3-pillow-devel-5.1.1-33.el8_10.aarch64.rpm
python3-pillow-doc-5.1.1-33.el8_10.noarch.rpm
python3-pillow-tk-5.1.1-33.el8_10.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/python-pillow-5.1.1-33.el8_10.src.rpm

Related CVEs:

CVE-2026-96640
CVE-2026-112391
CVE-2026-112392
CVE-2026-112397
CVE-2026-112402
CVE-2026-112405
CVE-2026-112406
CVE-2026-112892
CVE-2026-112894
CVE-2026-112895




Description of changes:

[5.1.1-33]
- CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded
  memory expansion in MSP image decoder
Resolves: RHEL-290437

[5.1.1-32]
- CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate
  page references in PDF files
Resolves: RHEL-289281

[5.1.1-31]
- CVE-2026-112406 python-pillow: pillow: Denial of Service via infinite loop
  during PDF page rewriting
Resolves: RHEL-287839

[5.1.1-30]
- CVE-2026-112402 python-pillow: pillow: Denial of service via double free
  during image transformation
Resolves: RHEL-287157

[5.1.1-29]
- CVE-2026-112894 python-pillow: pillow: Denial of Service via crafted
  multi-frame image conversion
Resolves: RHEL-287147

[5.1.1-28]
- CVE-2026-112895 python-pillow: pillow: Denial of service via crafted PDF
  during append operations
Resolves: RHEL-287152

[5.1.1-27]
- CVE-2026-112392 python-pillow: pillow: Denial of Service via zero-size
  images in rank filters
Resolves: RHEL-287128

[5.1.1-26]
- Security fix for CVE-2026-112397
Resolves: RHEL-287137

[5.1.1-25]
- CVE-2026-112391 python-pillow: Pillow: Denial of Service via unbounded recursion in PDF parser
Resolves: RHEL-287109

[5.1.1-24]
- CVE-2026-112405 python-pillow: Pillow: Denial of Service via null pointer dereference in Image.merge()
Resolves: RHEL-287123