Ubuntu: Urgent ADOdb Fix for CVE-2025-46337, Plus Pillow Patches

I noticed Ubuntu released USN-7530-2 and USN-8999-1 on 4 Nov. 2026, so I put them together for anyone maintaining PHP websites and server-side file processing. The first is an ADOdb patch for an existing CVE; the other covers Pillow, where you need to check which file readers or APIs the app exposes. The package name alone is not enough to make that call.

ADOdb: Conditional SQL injection, not a new CVE

CVE-2025-46337 affects ADOdb's PostgreSQL driver. Incorrect parameter escaping may allow input passed to pg_insert_id() to become part of an SQL statement. This requires the app to use PostgreSQL and pass user-controlled input to this method. Having ADOdb installed does not establish that the vulnerability is reachable; you also need to trace the calls, as described in the ADOdb advisory.

Upstream states that versions through 5.22.8 are affected and that 5.22.9 fixes the issue. USN-7530-2 extends the patches from USN-7530-1 to additional Ubuntu LTS releases, as shown in the table below; it is not a new vulnerability disclosure. I use the term SQL injection based on the details and the upstream advisory, even though the USN Overview refers more broadly to running programs, because the explanation of the mechanism confirms SQL execution, not RCE directly.

Read severity alongside the paths the app exposes

ADOdb assigns CVSS 3.1 = 10.0 Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L, and describes this as the worst-case usage scenario. This means that if the app exposes a path meeting the conditions, the impact on data is high and no user confirmation is needed, but it does not mean every PHP website is affected equally. Meanwhile, Ubuntu assigns a Medium priority, which uses different criteria from a CVSS score; the same page also labels the CVSS version as v3.0 while the vector is 3.1. I cite the version used by upstream and the published vector.

Pillow has no single score for the whole set. Examples that deserve particular attention are CVE-2026-59197, rated 8.2 High with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, and CVE-2026-59205, rated 7.5 High with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Both involve out-of-bounds memory writes. For the first, check who controls the rank filter size; for the second, check the ImageCms parameters and output image passed by the app.

Pillow: Check the file readers and APIs in use

USN-8999-1 covers the items below. If you run thumbnail generation, document processing, or workers that accept user files, compare these against the actual processing steps, not just the file extensions allowed by the website.

The Pillow 12.3.0 release notes confirm these fixes, with distinctions worth understanding: GD requires calling its reader directly and is not normally reached through Image.open(), while the PDF stream issue involves PdfParser and should not be interpreted as a vulnerability in every PDF reader. For rank filter and ImageCms, also examine where the app accepts user input against the conditions in the advisories.

Fixed versions and updating the copy actually in use

This table lists Ubuntu package versions from USN-7530-2 and USN-8999-1. Compare versions within the same Ubuntu release. An older-looking upstream version does not mean the package is still unpatched, because Ubuntu backports fixes.

Every ADOdb row in the table is listed as receiving patches through Ubuntu Pro / ESM Apps. Check entitlement and service status first. If APT does not offer the listed version, do not conclude that the machine is safe. For Pillow, the official sources disagree: Ubuntu's CVE-2026-59205 page, updated on 21 Sep. 2026, still shows Needs evaluation, but the USN dated 4 Nov. lists fixed versions. This table follows the newer USN.

cat /etc/os-release
dpkg-query -W -f='${Package}\t${Version}\n' libphp-adodb python3-pil
apt-cache policy libphp-adodb python3-pil
pro status

1. Prepare for the update Back up data and test in staging first
2. Select packages Select only packages that are actually installed. The following example is for a machine with both packages
3. Check the simulation Check the output of apt-get -s to confirm that the candidate versions match the table, then run the actual installation line

sudo apt update
apt-get -s install --only-upgrade libphp-adodb python3-pil
# ตรวจรายการเปลี่ยนแปลงก่อนรันบรรทัดถัดไป
sudo apt-get install --only-upgrade libphp-adodb python3-pil

If the app includes ADOdb through Composer or a copy placed directly in the project, APT does not patch that copy; you also need to update the app's dependency. For Pillow, check with the interpreter and account the worker actually uses, especially in virtual environments and containers:

python3 -c 'import sys, PIL; print(sys.executable); print(PIL.__version__); print(PIL.__file__)'
python3 -m pip show Pillow

The upstream Pillow release that fixes these issues is 12.3.0. Choose a version the project supports that includes these patches, using the lockfile and normal deployment process. Do not use version numbers from pip to judge Ubuntu packages with backported fixes. After the change, restart workers that still have the library loaded and test normal files supported by the app.

While waiting for an ADOdb patch, the developers recommend a workaround: pass only controlled input to $fieldname in pg_insert_id(), or escape it with pg_escape_identifier() before use. For Pillow, limiting file types, processing parameters, memory, and worker runtime is my risk-reduction advice, not a workaround guaranteed to address every CVE.

Review past symptoms and prioritize the work

The cited advisories do not provide an IOC set for determining whether a machine has been compromised. I recommend comparing application logs with database logs, looking for statements or data changes that do not match normal activity. For Pillow, look for workers hanging or crashing, memory spikes, and the same jobs being picked up repeatedly. These symptoms are leads for further investigation, not proof of an attack, and the absence of errors does not prove that the system is safe.

Retain request times, job IDs, and the files that triggered the issue according to your data policy. Do not reopen suspicious files on the production service to prove an issue. If you find abnormal behavior, isolate it for analysis in a controlled environment. For more on checking packages and supporting evidence, see Auditing Debian server security.

I would put ADOdb instances where external input reaches this method, and Pillow workers exposing APIs under the stated conditions, into an urgent patching round. If you have not yet found where they are used, check the inventory and code before moving them to the normal maintenance schedule. The important work is confirming that the patch reaches the copy the app actually loads, rather than stopping once the update command succeeds.

Sources: Ubuntu USN-7530-2, Ubuntu CVE-2025-46337, ADOdb advisory, Ubuntu USN-8999-1, Pillow 12.3.0 release notes, Pillow rank filter advisory, Pillow ImageCms advisory, Ubuntu CVE-2026-59205 Information current as of 5 Nov. 2026. I will come back and update this later.