CVE-2024-28219: Buffer Overflow

Q: What is the severity of CVE-2024-28219?

CVE-2024-28219 is classified as a high-severity vulnerability due to the potential for buffer overflow exploitation.

Q: How do I fix CVE-2024-28219?

To fix CVE-2024-28219, upgrade to Pillow version 10.3.0 or later for all affected platforms.

Q: Which versions of Pillow are affected by CVE-2024-28219?

Pillow versions prior to 10.3.0 are affected by CVE-2024-28219.

Q: What is the exploit mechanism for CVE-2024-28219?

CVE-2024-28219 exploits a buffer overflow resulting from the improper use of strcpy instead of strncpy.

Q: Is CVE-2024-28219 present in Debian packages?

Yes, CVE-2024-28219 affects several Debian packages, and users should upgrade to the specified remedial versions.

Published Apr 1, 2024

Updated

In imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

Affected Software

14 affected componentsFixes available

pip/pillow<10.3.0

10.3.0

Python Pillow<10.3.0

Debian Debian Linux=10.0

redhat/pillow<10.3.0

10.3.0

debian/pillow<9.4.0-1.1+deb12u1

9.4.0-1.1+deb12u1

debian/pillow<10.3.0-1

10.3.0-1

debian/pillow<10.3.0-1

10.3.0-1

debian/pillow

9.4.0-1.1+deb12u111.1.0-5+deb13u411.1.0-5+deb13u312.3.0-113.0.0-1

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

alpine/py3-pillow<10.3.0-r0

10.3.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/pillow to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade redhat/pillow to a version that resolves this vulnerability.
Fixed in 10.3.0
Upgrade
Upgrade debian/pillow to a version that resolves this vulnerability.
Fixed in 9.4.0-1.1+deb12u1
Upgrade
Upgrade debian/pillow to a version that resolves this vulnerability.
Fixed in 10.3.0-1
Upgrade
Upgrade debian/pillow to a version that resolves this vulnerability.
Fixed in 9.4.0-1.1+deb12u1Fixed in 11.1.0-5+deb13u4Fixed in 11.1.0-5+deb13u3Fixed in 12.3.0-1Fixed in 13.0.0-1
Upgrade
Upgrade alpine/py3-pillow to a version that resolves this vulnerability.
Fixed in 10.3.0-r0
Upgrade
Upgrade Pillow to a version that resolves this vulnerability.
Fixed in 10.3.0

Event History

Apr 1, 2024

Data Sourced

via Red Hat·11:34 PM

DescriptionSeverityAffected Software

Apr 3, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Data Sourced

via NVD·03:15 AM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:15 AM

DescriptionSeverityAffected Software

Advisory Published

via GitHub·03:30 AM

Parent advisories

This vulnerability appears in the following advisories.

DSA-5704

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-3786-1

Frequently Asked Questions

What is the severity of CVE-2024-28219?

CVE-2024-28219 is classified as a high-severity vulnerability due to the potential for buffer overflow exploitation.

How do I fix CVE-2024-28219?

To fix CVE-2024-28219, upgrade to Pillow version 10.3.0 or later for all affected platforms.

Which versions of Pillow are affected by CVE-2024-28219?

Pillow versions prior to 10.3.0 are affected by CVE-2024-28219.

What is the exploit mechanism for CVE-2024-28219?

CVE-2024-28219 exploits a buffer overflow resulting from the improper use of strcpy instead of strncpy.

Is CVE-2024-28219 present in Debian packages?

Yes, CVE-2024-28219 affects several Debian packages, and users should upgrade to the specified remedial versions.

CVE-2024-28219: Buffer Overflow

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2024-28219?

How do I fix CVE-2024-28219?

Which versions of Pillow are affected by CVE-2024-28219?

What is the exploit mechanism for CVE-2024-28219?

Is CVE-2024-28219 present in Debian packages?

Company

Resources

Contact