Back to Security Advisories

Pillow Vulnerabilities — Ubuntu Security Update (USN-8999-1)

USN-8999-1 fixes eleven Pillow vulnerabilities on Ubuntu (CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205), aggregate CVSS 9.1 (CWE-125 out-of-bounds read class) — image-parsing flaws including an McIdas AREA map-stride over-read. Update: sudo apt update && sudo apt upgrade and restart Python applications using Pillow.

Critical 9.1 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Pillow processes user-uploaded images across web applications — out-of-bounds reads leak process memory into converted output, and the batch's other flaws crash or corrupt the parsing worker on crafted uploads.

  1. Ubuntu Security Notices

  2. USN-8997-1

Publication date

4 November 2026

Overview

Net-SNMP could be made to stop responding if it received specially crafted
network traffic.

Releases


26.04 LTS


24.04 LTS


22.04 LTS

Packages

  • net-snmp – SNMP (Simple Network Management Protocol) server and applications

Details

It was discovered that Net-SNMP incorrectly handled newly accepted
connections in the SMUX module. An unauthenticated remote attacker could
possibly use this issue to cause Net-SNMP to block indefinitely,
resulting in a denial of service.

It was discovered that Net-SNMP incorrectly handled newly accepted
connections in the SMUX module. An unauthenticated remote attacker could
possibly use this issue to cause Net-SNMP to block indefinitely,
resulting in a denial of service.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.04

LTS resolute

 libsnmp40t64 – 

5.9.4+dfsg-2ubuntu3.1
snmp – 

5.9.4+dfsg-2ubuntu3.1
snmpd – 

5.9.4+dfsg-2ubuntu3.1
24.04

LTS noble

 libsnmp40t64 – 

5.9.4+dfsg-1.1ubuntu3.3
snmp – 

5.9.4+dfsg-1.1ubuntu3.3
snmpd – 

5.9.4+dfsg-1.1ubuntu3.3
22.04

LTS jammy

 libsnmp40 – 

5.9.1+dfsg-1ubuntu2.10
snmp – 

5.9.1+dfsg-1ubuntu2.10
snmpd – 

5.9.1+dfsg-1ubuntu2.10

References

Frequently Asked Questions

What is USN-8999-1?
It is Ubuntu's Pillow security notice fixing eleven CVEs (CVE-2026-54058, CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197, CVE-2026-59199, CVE-2026-59200, CVE-2026-59203, CVE-2026-59204, CVE-2026-59205) — memory-safety flaws in image decoding including an McIdas AREA map-stride over-read. Aggregate CVSS 9.1.
Who is affected?
Ubuntu servers with Pillow installed where untrusted images are processed — upload thumbnailing, format conversion and OCR-adjacent pipelines on Python web applications.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade for the Pillow packages and restart the Python applications/workers using Pillow so they load the patched library.
Is the McIdas format a realistic attack vector?
The format barely matters — a decoder flaw triggered by a crafted image file is exploitable through any upload path that passes the file to Pillow, whatever the claimed format inside the file.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System