CVE-2024-28219 (MEDIO 5.9) · Watchpost

← All vulnerabilities

Pillow buffer overflow vulnerability

MEDIO 5.9CVE-2024-28219 · BIT-pillow-2024-28219 · GHSA-44wm-f244-xhp3 · Published 03/04/2024 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 10.3.0`	`10.3.0`
pillow python	`< 10.3.0`	`10.3.0`

Description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

NVD description

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

References

nvd.nist.gov/vuln/detail/CVE-2024-28219 · ADVISORY
python-pillow/Pillow commit 2a93aba · WEB
python-pillow/Pillow · PACKAGE
lists.debian.org/debian-lts-announce/2024/04/msg00008.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M · WEB
pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M · Broken Link
lists.fedoraproject.org/archives/list/[email protected]/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M
pypi.org/project/pillow · PACKAGE
GitHub Advisory GHSA-44wm-f244-xhp3 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free