SOURCES/CVE-2024-28219.patch

@@ -1,38 +0,0 @@
-From 2d30e67ec0b77993de62f975aae29266d8d1f784 Mon Sep 17 00:00:00 2001
-From: Lumir Balhar <lbalhar@redhat.com>
-Date: Thu, 4 Apr 2024 13:01:56 +0200
-Subject: [PATCH] CVE-2024-28219
-
----
- src/_imagingcms.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/_imagingcms.c b/src/_imagingcms.c
-index 5e4196c..4169e28 100644
---- a/src/_imagingcms.c
-+++ b/src/_imagingcms.c
-@@ -212,8 +212,8 @@ cms_transform_new(cmsHTRANSFORM transform, char* mode_in, char* mode_out)
- 
-     self->transform = transform;
- 
--    strcpy(self->mode_in, mode_in);
--    strcpy(self->mode_out, mode_out);
-+    strncpy(self->mode_in, mode_in, 8);
-+    strncpy(self->mode_out, mode_out, 8);
- 
-     return (PyObject*) self;
- }
-@@ -286,8 +286,8 @@ findLCMStype(char* PILmode)
-     }
- 
-     else {
--        /* take a wild guess... but you probably should fail instead. */
--        return TYPE_GRAY_8; /* so there's no buffer overrun... */
-+        /* take a wild guess... */
-+        return TYPE_GRAY_8;
-     }
- }
- 
--- 
-2.44.0
-

SOURCES/CVE-2026-54059_54060_55379.patch

@@ -1,63 +0,0 @@
-From e616649b74319752628c78b5e72a16cf120c1bb6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
-Date: Wed, 8 Jul 2026 13:02:14 +0000
-Subject: [PATCH 1/2] Add decompression bomb checks to FontFile classes
-
-Fixes CVE-2026-54059, CVE-2026-54060, CVE-2026-55379
-Backport of upstream commit 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
----
- src/PIL/BdfFontFile.py | 2 ++
- src/PIL/FontFile.py    | 4 +++-
- src/PIL/PcfFontFile.py | 1 +
- 3 files changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/PIL/BdfFontFile.py b/src/PIL/BdfFontFile.py
-index c8bc604..a0c78b8 100644
---- a/src/PIL/BdfFontFile.py
-+++ b/src/PIL/BdfFontFile.py
-@@ -75,6 +75,8 @@ def bdf_char(f):
- 
-     bbox = (dx, dy), (l, -d-y, x+l, -d), (0, 0, x, y)
- 
-+    Image._decompression_bomb_check((x, y))
-+
-     try:
-         im = Image.frombytes("1", (x, y), bitmap, "hex", "1")
-     except ValueError:
-diff --git a/src/PIL/FontFile.py b/src/PIL/FontFile.py
-index 46e49bc..bc68af3 100644
---- a/src/PIL/FontFile.py
-+++ b/src/PIL/FontFile.py
-@@ -58,7 +58,7 @@ class FontFile(object):
-             if glyph:
-                 d, dst, src, im = glyph
-                 h = max(h, src[3] - src[1])
--                w = w + (src[2] - src[0])
-+                w += src[2] - src[0]
-                 if w > WIDTH:
-                     lines += 1
-                     w = (src[2] - src[0])
-@@ -70,6 +70,8 @@ class FontFile(object):
-         if xsize == 0 and ysize == 0:
-             return ""
- 
-+        Image._decompression_bomb_check((xsize, ysize))
-+
-         self.ysize = h
- 
-         # paste glyphs into bitmap
-diff --git a/src/PIL/PcfFontFile.py b/src/PIL/PcfFontFile.py
-index eba85fe..3fdb505 100644
---- a/src/PIL/PcfFontFile.py
-+++ b/src/PIL/PcfFontFile.py
-@@ -213,6 +213,7 @@ class PcfFontFile(FontFile.FontFile):
- 
-         for i in range(nbitmaps):
-             x, y, l, r, w, a, d, f = metrics[i]
-+            Image._decompression_bomb_check((x, y))
-             b, e = offsets[i], offsets[i+1]
-             bitmaps.append(
-                 Image.frombytes("1", (x, y), data[b:e], "raw", mode, pad(x))
--- 
-2.54.0
-

SOURCES/CVE-2026-55380.patch

@@ -1,36 +0,0 @@
-From 5b9cc2556f54493f15420ecc842c54b81845930d Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Lum=C3=ADr=20Balhar?= <lbalhar@redhat.com>
-Date: Wed, 8 Jul 2026 13:03:39 +0000
-Subject: [PATCH 2/2] Add decompression bomb check to GdImageFile
-
-Fixes CVE-2026-55380
-Backport of upstream commit f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
----
- src/PIL/GdImageFile.py | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/PIL/GdImageFile.py b/src/PIL/GdImageFile.py
-index 09ab5ec..f3c0e1d 100644
---- a/src/PIL/GdImageFile.py
-+++ b/src/PIL/GdImageFile.py
-@@ -23,7 +23,7 @@
- # purposes only.
- 
- 
--from . import ImageFile, ImagePalette
-+from . import Image, ImageFile, ImagePalette
- from ._binary import i16be as i16
- from ._util import isPath
- 
-@@ -55,6 +55,8 @@ class GdImageFile(ImageFile.ImageFile):
-         self.mode = "L"  # FIXME: "P"
-         self.size = i16(s[0:2]), i16(s[2:4])
- 
-+        Image._decompression_bomb_check(self.size)
-+
-         # transparency index
-         tindex = i16(s[5:7])
-         if tindex < 256:
--- 
-2.54.0
-

SPECS/python-pillow.spec

@@ -8,7 +8,7 @@
 
 Name:           python-%{srcname}
 Version:        5.1.1
-Release:        22%{?dist}
+Release:        20%{?dist}
 Summary:        Python image processing library
 
 # License: see http://www.pythonware.com/products/pil/license.htm
@@ -121,18 +121,6 @@ Patch21:        CVE-2023-44271.patch
 # Upstream fix: https://github.com/python-pillow/Pillow/commit/02c6183d41c68a8dd080f5739f566bd82485822d
 # Patch rebased and tests converted from pytest to unittests.
 Patch22:        CVE-2023-50447.patch
-# CVE-2024-28219 python-pillow: buffer overflow in _imagingcms.c
-# Upstream fix: https://github.com/python-pillow/Pillow/pull/7928
-# Patch rebased. The test requires a binary file and therefore isn't backported.
-Patch23:        CVE-2024-28219.patch
-# CVE-2026-54059 python-pillow: uncontrolled memory allocation in PcfFontFile._load_bitmaps()
-# CVE-2026-54060 python-pillow: uncontrolled memory allocation in FontFile.compile()
-# CVE-2026-55379 python-pillow: uncontrolled memory allocation in BdfFontFile bdf_char()
-# Upstream fix: https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
-Patch24:        CVE-2026-54059_54060_55379.patch
-# CVE-2026-55380 python-pillow: uncontrolled memory allocation in GdImageFile
-# Upstream fix: https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
-Patch25:        CVE-2026-55380.patch
 
 BuildRequires:  freetype-devel
 BuildRequires:  gcc
@@ -277,14 +265,6 @@ popd
 
 
 %changelog
-* Wed Jul 08 2026 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-22
-- Security fix for CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380
-Resolves: RHEL-192830, RHEL-192770, RHEL-192684, RHEL-192731
-
-* Thu Apr 04 2024 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-21
-- Security fix for CVE-2024-28219
-Resolves: RHEL-31071
-
 * Thu Jan 25 2024 Lumír Balhar <lbalhar@redhat.com> - 5.1.1-20
 - Security fix for CVE-2023-50447
 Resolves: RHEL-22240