From 9129c27a01a4b07b341b11cf9b21169466deba94 Mon Sep 17 00:00:00 2001 From: Yogita Urade Date: Thu, 15 Oct 2026 23:23:22 -0700 Subject: [PATCH] python3-pillow: Fix CVE-2026-59205 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 [2] https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6 Signed-off-by: Yogita Urade Signed-off-by: Anuj Mittal --- .../python3-pillow/CVE-2026-59205.patch | 66 +++++++++++++++++++ .../python/python3-pillow_12.2.0.bb | 1 + 2 files changed, 67 insertions(+) create mode 100644 meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch diff --git a/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch new file mode 100644 index 0000000000..5cac7e05d1 --- /dev/null +++ b/meta-python/recipes-devtools/python/python3-pillow/CVE-2026-59205.patch @@ -0,0 +1,66 @@ +From a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721 Mon Sep 17 00:00:00 2001 +From: Andrew Murray +Date: Sat, 20 Jun 2026 21:18:14 +1000 +Subject: [PATCH] Raise error if image modes do not match ImageCms transform + modes (#9715) + +CVE: CVE-2026-59205 +Upstream-Status: Backport [https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721] + +(cherry picked from commit 066e349b8e20f6e0400683ff988ac72eea24c049) +(cherry picked from commit 7f6e9d696913bba9fd1a6cf0b53f4a313dc25329) +(cherry picked from commit 642d806703c62d4160f3eb8ff25fb63cbedadd98) +Signed-off-by: Yogita Urade +--- + Tests/test_imagecms.py | 4 ++++ + src/PIL/ImageCms.py | 16 +++++++++------- + 2 files changed, 13 insertions(+), 7 deletions(-) + +diff --git a/Tests/test_imagecms.py b/Tests/test_imagecms.py +index d73ab34282b..3382a34e47c 100644 +--- a/Tests/test_imagecms.py ++++ b/Tests/test_imagecms.py +@@ -196,6 +196,10 @@ def test_exceptions() -> None: + psRGB = ImageCms.createProfile("sRGB") + pLab = ImageCms.createProfile("LAB") + t = ImageCms.buildTransform(pLab, psRGB, "LAB", "RGB") ++ with pytest.raises(ValueError, match="mode mismatch"): ++ t.apply(hopper("RGBA")) ++ with pytest.raises(ValueError, match="mode mismatch"): ++ t.apply(hopper("LAB"), hopper("RGBA")) + with pytest.raises(ValueError, match="mode mismatch"): + t.apply_in_place(hopper("RGBA")) + +diff --git a/src/PIL/ImageCms.py b/src/PIL/ImageCms.py +index 513e28acf..388a9296f 100644 +--- a/src/PIL/ImageCms.py ++++ b/src/PIL/ImageCms.py +@@ -317,19 +317,21 @@ class ImageCmsTransform(Image.ImagePointHandler): + return self.apply(im) + + def apply(self, im: Image.Image, imOut: Image.Image | None = None) -> Image.Image: +- if imOut is None: ++ if im.mode != self.input_mode: ++ msg = "mode mismatch" ++ raise ValueError(msg) ++ if imOut is not None: ++ if imOut.mode != self.output_mode: ++ msg = "mode mismatch" ++ raise ValueError(msg) ++ else: + imOut = Image.new(self.output_mode, im.size, None) + self.transform.apply(im.getim(), imOut.getim()) + imOut.info["icc_profile"] = self.output_profile.tobytes() + return imOut + + def apply_in_place(self, im: Image.Image) -> Image.Image: +- if im.mode != self.output_mode: +- msg = "mode mismatch" +- raise ValueError(msg) # wrong output mode +- self.transform.apply(im.getim(), im.getim()) +- im.info["icc_profile"] = self.output_profile.tobytes() +- return im ++ return self.apply(im, im) + + + def get_display_profile(handle: SupportsInt | None = None) -> ImageCmsProfile | None: diff --git a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb index c9926ba076..e5ef7b34bf 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_12.2.0.bb @@ -16,6 +16,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https; file://CVE-2026-59199.patch \ file://CVE-2026-59200.patch \ file://CVE-2026-59203.patch \ + file://CVE-2026-59205.patch \ " SRCREV = "3c41c095064200a02672d89cc5ff629eaf4b0d4f"