SUSE-SU-2026:5038-1: Security update for python-Pillow

This update for python-Pillow fixes the following issues:

- CVE-2026-96636: decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (bsc#1286802). - CVE-2026-96637: decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS (bsc#1286801). - CVE-2026-96640: PDF append accepts malformed shared page-tree DAG, which can cause resource exhaustion (bsc#1286798). - CVE-2026-96641: reachable undefined behavior in native integer operations can lead to denial of service or logic integrity compromise (bsc#1286797). - CVE-2026-96642: TarIO negative size field causes infinite CPU-spin loop (bsc#1286796). - CVE-2026-112390: Denial of Service via infinite loop during crafted MIC image parsing (bsc#1286256). - CVE-2026-112391: Denial of Service via unbounded recursion in PDF parser (bsc#1286273). - CVE-2026-112392: Denial of Service via zero-size images in rank filters (bsc#1286287). - CVE-2026-112393: heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data (bsc#1286325). - CVE-2026-112394: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size (bsc#1286311). - CVE-2026-112397: out-of-bounds access in imagingmorph on a zero-width image (bsc#1286314). - CVE-2026-112398: heap buffer overflow in FPX JPEG decoding can lead to code execution (bsc#1286406). - CVE-2026-112399: Denial of service via crafted APNG image (bsc#1286368). - CVE-2026-112400: Denial of Service via memory exhaustion from crafted GIF image (bsc#1286370). - CVE-2026-112401: Denial of Service via crafted GIF comments (bsc#1286372). - CVE-2026-112402: Denial of service via double free during image transformation (bsc#1286381). - CVE-2026-112403: heap buffer overflow in ImagingJpegDecode allows for code execution (bsc#1286405). - CVE-2026-112405: NULL pointer dereference in Image.merge via an unvalidated band 0 (bsc#1286404). - CVE-2026-112406: infinite loop in PdfParser.rewritepages on page tree Parent cycle (bsc#1286403). - CVE-2026-112891: quadratic GIF comment copying during save (bsc#1286402). - CVE-2026-112892: MSP RLE decoder expands a tiny file into unbounded memory (bsc#1286401). - CVE-2026-112894: Denial of Service via crafted multi-frame image conversion (bsc#1286408). - CVE-2026-112895: Denial of service via crafted PDF during append operations (bsc#1286411). - CVE-2026-112896: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read (bsc#1286400). - CVE-2026-112897: TiffDecode returns uninitialized memory as pixels for short JPEG strips (bsc#1286398). - CVE-2026-112899: EPS load(scale) lets Ghostscript render past the decompression bomb limit (bsc#1286489). - CVE-2026-112900: argument Injection in Ghostscript call can lead to remote code execution (bsc#1286397). - CVE-2026-112901: ReDoS in XbmImagePlugin can be triggered by 512-byte file (bsc#1286396). - CVE-2026-112902: memory disclosure and segfault in libtiff encoder via crafted TIFF tags (bsc#1286804).