CVE-2024-28219
Fixed in a distro release EPSS <1%CVSS 6.7
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
Products: fedoraproject fedora, python pillow, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | pillow | 10.3.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | python3-pillow | 5.1.1-21.el8_10 |
| AlmaLinux 8 | python3-pillow-devel | 5.1.1-21.el8_10 |
| AlmaLinux 8 | python3-pillow-doc | 5.1.1-21.el8_10 |
| AlmaLinux 8 | python3-pillow-tk | 5.1.1-21.el8_10 |
| Amazon Linux 2023 | python3-pillow | 9.4.0-2.amzn2023.0.6 |
| Amazon Linux 2023 | python3-pillow-devel | 9.4.0-2.amzn2023.0.6 |
| Amazon Linux 2023 | python3-pillow-tk | 9.4.0-2.amzn2023.0.6 |
| Chainguard | kubeflow-pipelines-visualization-server | 2.2.0-r0 |
| Chainguard | py3-pillow | 10.3.0-r0 |
| Chainguard | py3-seaborn | 0.13.2-r3 |
| Chainguard | py3-supported-seaborn | 0.13.2-r3 |
| Chainguard | py3.10-seaborn | 0.13.2-r3 |
| Chainguard | py3.11-seaborn | 0.13.2-r3 |
| Chainguard | py3.12-seaborn | 0.13.2-r3 |
| Chainguard | py3.13-seaborn | 0.13.2-r3 |
| Debian 10 | pillow | 5.4.1-2+deb10u6 |
| Debian 11 | pillow | 8.1.2+dfsg-0.3+deb11u2 |
| Debian 12 | pillow | 9.4.0-1.1+deb12u1 |
| Debian 13 | pillow | 10.3.0-1 |
| Debian 14 | pillow | 10.3.0-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | automation-hub | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-aiohttp-debugsource | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pillow-debugsource | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-aiohttp-debuginfo | 0:3.9.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-galaxy-ng | 0:4.9.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-gunicorn | 0:22.0.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pillow-debuginfo | 0:10.3.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-pydantic | 0:1.10.15-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-social-auth-app-django | 0:5.4.1-1.el9ap |
| Red Hat ansible automation platform 2.4 | python3-sqlparse | 0:0.5.0-1.el9ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-aiohttp-debuginfo | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pillow-debuginfo | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python39-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-aiohttp-debugsource | 0:3.9.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-galaxy-ng | 0:4.9.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-gunicorn | 0:22.0.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pillow-debugsource | 0:10.3.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-pydantic | 0:1.10.15-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-social-auth-app-django | 0:5.4.1-1.el8ap |
| Red Hat ansible automation platform 2.4 | python3x-sqlparse | 0:0.5.0-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-idna | 0:3.7-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python3-requests | 0:2.32.2-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python39-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-idna | 0:3.7-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | python3x-requests | 0:2.32.2-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform developer 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-cryptography-debugsource | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-black | 0:22.8.0-2.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-cryptography-debuginfo | 0:42.0.5-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python3-jinja2 | 0:3.1.4-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | python39-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-cryptography-debuginfo | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python39-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-black | 0:22.8.0-2.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-cryptography-debugsource | 0:42.0.5-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | python3x-jinja2 | 0:3.1.4-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el9ap |
| Red Hat ansible automation platform inside 2.4 | receptor | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el8ap |
| Red Hat ansible automation platform inside 2.4 | receptorctl | 0:1.4.8-1.el9ap |
| Red Hat Enterprise Linux 8 | python-pillow | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python-pillow-debuginfo | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python-pillow-debugsource | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow-debuginfo | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow-devel | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow-doc | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow-tk | 0:5.1.1-21.el8_10 |
| Red Hat Enterprise Linux 8 | python3-pillow-tk-debuginfo | 0:5.1.1-21.el8_10 |
| Red Hat satellite 6.15 | python-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python-aiohttp-debugsource | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python-django | 0:4.2.14-1.el8pc |
| Red Hat satellite 6.15 | python-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite 6.15 | python-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python-pillow-debugsource | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-django | 0:4.2.14-1.el8pc |
| Red Hat satellite 6.15 | python3.11-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite 6.15 | python3.11-pillow-debuginfo | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-aiohttp-debugsource | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-django | 0:4.2.14-1.el8pc |
| Red Hat satellite capsule 6.15 | python-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python-pillow-debugsource | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-aiohttp-debuginfo | 0:3.9.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-django | 0:4.2.14-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-jinja2 | 0:3.1.4-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pillow | 0:10.3.0-1.el8pc |
| Red Hat satellite capsule 6.15 | python3.11-pillow-debuginfo | 0:10.3.0-1.el8pc |
| Rocky Linux 8 | python-pillow | 0:5.1.1-21.el8_10 |
| SUSE HPE Helion OpenStack 8 | python-Pillow | 4.2.1-3.29.2 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-horizon-hpe | 12.0.5~dev6-14.58.2 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-Pillow | 9.5.0-150400.5.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.15.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-Pillow | 9.5.0-150400.5.15.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-Pillow | 9.5.0-150400.5.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-Pillow | 9.5.0-150400.5.15.1 |
| SUSE OpenStack Cloud 8 | python-Pillow | 4.2.1-3.29.2 |
| SUSE OpenStack Cloud 8 | venv-openstack-horizon | 12.0.5~dev6-14.58.2 |
| SUSE OpenStack Cloud 9 | python-Pillow | 5.2.0-3.26.2 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.55.2 |
| SUSE OpenStack Cloud Crowbar 8 | python-Pillow | 4.2.1-3.29.2 |
| SUSE OpenStack Cloud Crowbar 9 | python-Pillow | 5.2.0-3.26.2 |
| Ubuntu 20.04 LTS | pillow | 7.0.0-4ubuntu0.9 |
| Ubuntu 22.04 LTS | pillow | 9.0.1-1ubuntu0.3 |
| Ubuntu 24.04 LTS | pillow | 10.2.0-1ubuntu1 |
| Ubuntu Pro 14.04 LTS | pillow | 2.3.0-1ubuntu3.4+esm4 |
| Ubuntu Pro 16.04 LTS | pillow | 3.1.2-0ubuntu1.6+esm2 |
| Ubuntu Pro 18.04 LTS | pillow | 5.1.0-1ubuntu0.8+esm1 |
| Ubuntu Pro 20.04 LTS | pillow-python2 | 6.2.1-3ubuntu0.1~esm2 |
| Wolfi | kubeflow-pipelines-visualization-server | 2.2.0-r0 |
| Wolfi | py3-pillow | 10.3.0-r0 |
| Wolfi | py3-seaborn | 0.13.2-r3 |
| Wolfi | py3-supported-seaborn | 0.13.2-r3 |
| Wolfi | py3.10-seaborn | 0.13.2-r3 |
| Wolfi | py3.11-seaborn | 0.13.2-r3 |
| Wolfi | py3.12-seaborn | 0.13.2-r3 |
| Wolfi | py3.13-seaborn | 0.13.2-r3 |
| openSUSE Leap 15.5 | python-Pillow | 7.2.0-150300.3.9.1 |
| openSUSE Leap 15.5 | python-Pillow | 9.5.0-150400.5.15.1 |
| openSUSE Tumbleweed | python-Pillow | 10.3.0-1.1 |
| openSUSE Tumbleweed | python-Pillow | 12.3.0-1.1 |