We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)
Bugpilot (Bug tracking)

Ok

THREATINT CVE Home CVE Diag Help
PUBLISHED

CVE-2024-28219

Reserved:2024-03-07
Published:2024-04-03
Updated:2024-04-10

Description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.



MEDIUM: 6.7CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R

References

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/ (FEDORA-2024-e4b1b4eab1) vendor-advisory

https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html ([debian-lts-announce] 20240410 [SECURITY] [DLA 3786-1] pillow security update) mailing-list

cve.org CVE-2024-28219

nvd.nist.gov CVE-2024-28219

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-28219