In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-python3-pillowalma-upgrade-python3-pillow-develalma-upgrade-python3-pillow-docalma-upgrade-python3-pillow-tk | Jul 4, 2024 | Apr 3, 2024 | |
| Alpine Linux | alpine-linux-upgrade-py3-pillow | Aug 22, 2024 | Apr 3, 2024 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-python3-pillowamazon-linux-2023-upgrade-python3-pillow-debuginfoamazon-linux-2023-upgrade-python3-pillow-develamazon-linux-2023-upgrade-python3-pillow-tkamazon-linux-2023-upgrade-python3-pillow-tk-debuginfoamazon-linux-2023-upgrade-python-pillow-debuginfoamazon-linux-2023-upgrade-python-pillow-debugsource | Feb 17, 2025 | Apr 1, 2024 | |
| Debian | debian-upgrade-pillow | Apr 12, 2024 | Apr 3, 2024 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-python-pillow | Nov 18, 2024 | Apr 3, 2024 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-python3-pillow | Jul 16, 2024 | Apr 3, 2024 | |
| Huawei Euleros 2_0_sp11 | huawei-euleros-2_0_sp11-upgrade-python3-pillow | Jun 26, 2024 | Apr 3, 2024 | |
| Huawei Euleros 2_0_sp12 | huawei-euleros-2_0_sp12-upgrade-python3-pillow | Oct 8, 2024 | Apr 3, 2024 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-python2-pillowhuawei-euleros-2_0_sp8-upgrade-python3-pillow | Jul 23, 2024 | Apr 3, 2024 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-python3-pillow | Oct 8, 2024 | Apr 3, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-python3-pilloworacle-linux-upgrade-python3-pillow-develoracle-linux-upgrade-python3-pillow-docoracle-linux-upgrade-python3-pillow-tk | Jul 3, 2024 | Apr 1, 2024 |
| Redhat_linux | redhat-upgrade-python-pillow-debuginforedhat-upgrade-python-pillow-debugsourceredhat-upgrade-python3-pillowredhat-upgrade-python3-pillow-debuginforedhat-upgrade-python3-pillow-develredhat-upgrade-python3-pillow-docredhat-upgrade-python3-pillow-tkredhat-upgrade-python3-pillow-tk-debuginfo | Jul 3, 2024 | Apr 3, 2024 | |
| Rocky_linux | rocky-upgrade-python-pillow-debuginforocky-upgrade-python-pillow-debugsourcerocky-upgrade-python3-pillowrocky-upgrade-python3-pillow-debuginforocky-upgrade-python3-pillow-develrocky-upgrade-python3-pillow-tkrocky-upgrade-python3-pillow-tk-debuginfo | Jul 16, 2024 | Apr 3, 2024 | |
| Suse | — | suse-upgrade-python3-pillowsuse-upgrade-python3-pillow-tksuse-upgrade-python311-pillowsuse-upgrade-python311-pillow-tksuse-upgrade-python313-pillowsuse-upgrade-python313-pillow-tk | Apr 9, 2024 | Apr 3, 2024 |
| Ubuntu | ubuntu-pro-upgrade-python-pilubuntu-pro-upgrade-python3-pilubuntu-upgrade-python3-pil | Apr 23, 2024 | Apr 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub