{"id":"CLSA-2026-1792164435","summary":"Fix CVE(s): CVE-2026-54058, CVE-2026-59199","details":"   * SECURITY UPDATE: heap out-of-bounds write via paste box coordinates\n     near the signed 32-bit integer limits (ELSCVE-233283)\n     - debian/patches/CVE-2026-59199.patch: compute the paste box\n       dimensions as int64_t in ImagingPaste() and ImagingFill2() in\n       src/libImaging/Paste.c. Adds a regression test in\n       Tests/test_image_paste.py.\n     - CVE-2026-59199\n   * SECURITY UPDATE: out-of-bounds read when memory-mapping McIdas AREA\n     images with an undersized row stride (ELSCVE-233312)\n     - debian/patches/CVE-2026-54058.patch: raise the row stride to at\n       least one full row of pixels in PyImaging_MapBuffer() in src/map.c.\n       Adds a regression test in Tests/test_file_mcidas.py.\n     - CVE-2026-54058","modified":"2026-10-26T09:32:04.582147888Z","published":"2026-10-16T15:27:27Z","upstream":["CVE-2026-54058","CVE-2026-59199"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1792164435.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59199"}],"affected":[{"package":{"name":"python-pil","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792164435.json"}},{"package":{"name":"python-pil-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792164435.json"}},{"package":{"name":"python-pil.imagetk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python-pil.imagetk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792164435.json"}},{"package":{"name":"python3-pil","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3-pil?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792164435.json"}},{"package":{"name":"python3-pil.imagetk","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/python3-pil.imagetk?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-1ubuntu0.8+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1792164435.json"}}],"schema_version":"1.9.0"}