In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-pillow-docUpgrade python3-pillowUpgrade python3-pillow-develUpgrade python3-pillow-tk | Jul 4, 2024 | Apr 3, 2024 |
| Alpine Linux | — | Upgrade py3-pillow | Aug 22, 2024 | Apr 3, 2024 |
| Amazon_linux_2023 | — | Upgrade python3-pillow-tkUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillowUpgrade python-pillow-debuginfoUpgrade python3-pillow-develUpgrade python-pillow-debugsourceUpgrade python3-pillow-debuginfo | Feb 17, 2025 | Apr 1, 2024 |
| Debian | — | Upgrade pillow | Apr 12, 2024 | Apr 3, 2024 |
| Gentoo Linux | — | Upgrade dev-python/pillow. | Nov 18, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-pillow | Jul 16, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-pillow | Jun 26, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-pillow | Oct 8, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-pillowUpgrade python2-pillow | Jul 23, 2024 | Apr 3, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-pillow | Oct 8, 2024 | Apr 3, 2024 |
| Oracle_linux | — | Upgrade python3-pillowUpgrade python3-pillow-docUpgrade python3-pillow-develUpgrade python3-pillow-tk | Jul 3, 2024 | Apr 1, 2024 |
| Redhat_linux | — | Upgrade python-pillow-debugsourceUpgrade python3-pillow-docUpgrade python3-pillow-tkUpgrade python3-pillow-develUpgrade python3-pillowUpgrade python3-pillow-debuginfoUpgrade python3-pillow-tk-debuginfoNo solution existsUpgrade python-pillow-debuginfo | Jul 3, 2024 | Apr 3, 2024 |
| Rocky_linux | — | Upgrade python3-pillow-tkUpgrade python3-pillow-tk-debuginfoUpgrade python3-pillowUpgrade python3-pillow-debuginfoUpgrade python3-pillow-develUpgrade python-pillow-debugsourceUpgrade python-pillow-debuginfo | Jul 16, 2024 | Apr 3, 2024 |
| Suse | — | Upgrade python311-Pillow-tkUpgrade python313-Pillow-tkUpgrade python3-pillowUpgrade python311-PillowUpgrade python3-pillow-tkUpgrade python313-Pillow | Apr 9, 2024 | Apr 3, 2024 |
| Ubuntu | — | Upgrade python3-pil (Ubuntu Pro)Upgrade python3-pilUpgrade python-pil (Ubuntu Pro) | Apr 23, 2024 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub