ALAS2023-2026-1985

References: CVE-2026-54059  CVE-2026-54060  CVE-2026-55379  CVE-2026-55380 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0. (CVE-2026-54059)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0. (CVE-2026-54060)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0. (CVE-2026-55379)

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0. (CVE-2026-55380)

Issue Correction:
Run dnf update python-pillow --releasever 2023.12.20260720 or dnf update --advisory ALAS2023-2026-1985 --releasever 2023.12.20260720 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation

New Packages:

aarch64:
    python-pillow-debuginfo-9.4.0-2.amzn2023.0.9.aarch64
    python3-pillow-debuginfo-9.4.0-2.amzn2023.0.9.aarch64
    python3-pillow-tk-debuginfo-9.4.0-2.amzn2023.0.9.aarch64
    python3-pillow-devel-9.4.0-2.amzn2023.0.9.aarch64
    python-pillow-debugsource-9.4.0-2.amzn2023.0.9.aarch64
    python3-pillow-tk-9.4.0-2.amzn2023.0.9.aarch64
    python3-pillow-9.4.0-2.amzn2023.0.9.aarch64

src:
    python-pillow-9.4.0-2.amzn2023.0.9.src

x86_64:
    python3-pillow-debuginfo-9.4.0-2.amzn2023.0.9.x86_64
    python-pillow-debugsource-9.4.0-2.amzn2023.0.9.x86_64
    python3-pillow-tk-debuginfo-9.4.0-2.amzn2023.0.9.x86_64
    python-pillow-debuginfo-9.4.0-2.amzn2023.0.9.x86_64
    python3-pillow-devel-9.4.0-2.amzn2023.0.9.x86_64
    python3-pillow-tk-9.4.0-2.amzn2023.0.9.x86_64
    python3-pillow-9.4.0-2.amzn2023.0.9.x86_64