CVE-2024-28219
published 2024-04-03CVE-2024-28219: In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.99%
58.6th percentile
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | pillow | < pillow 9.4.0-1.1+deb12u1 (bookworm) | pillow 9.4.0-1.1+deb12u1 (bookworm) |
| python | pillow | < 10.3.0 | 10.3.0 |
| python | pillow | >= 0 < 8.1.2+dfsg-0.3+deb11u2 | 8.1.2+dfsg-0.3+deb11u2 |
| python | pillow | >= 0 < 9.4.0-1.1+deb12u1 | 9.4.0-1.1+deb12u1 |
| python | pillow | >= 0 < 10.3.0-1 | 10.3.0-1 |
| python | pillow | >= 0 < 10.3.0-1 | 10.3.0-1 |
| python | pillow | >= 0 < 10.3.0 | 10.3.0 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian6.7MEDIUM
vendor_oracle6.7MEDIUM
vendor_redhat6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Schneider Electric EcoStruxure Power Operation (Update A)
cisa_ics·2026-02-26·CVSS 9.8
[CRITICAL] Schneider Electric EcoStruxure Power Operation (Update A)
ICS Advisory
##
Schneider Electric EcoStruxure Power Operation (Update A)
Last RevisedFebruary 26, 2026
Alert CodeICSA-25-203-04
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could result in the loss of system functionality or unauthorized access to system functions.
The following versions of Schneider Electric EcoStruxure Power Operation (Update A) are affected:
- EcoStruxure Power Operation (EPO) 2022 <=CU6 (CVE-2023-50447, CVE-2024-28219, CVE-2022-45198, CVE-2023-5217, CVE-2023-35945, CVE-2023-44487)
- EcoStruxure Power Operation (EPO) 2024 <=CU1 (CVE-2023-50447, CVE-2024-28219, CVE-2022-45198, CVE-2023-5217, CVE-2023-35945, CVE-2023-44487)
CVS
Oracle
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Pillow) — CVE-2024-28219
vendor_oracle·2025-04-15·CVSS 6.7
CVE-2024-28219 [MEDIUM] Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Pillow) — CVE-2024-28219
Oracle Oracle Communications Risk Matrix: Configuration Management Platform (Pillow) vulnerability
CVE: CVE-2024-28219
CVSS: 6.7
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Communications Risk Matrix: Install (Pillow) — CVE-2024-28219
vendor_oracle·2025-01-15·CVSS 6.7
CVE-2024-28219 [MEDIUM] Oracle Oracle Communications Risk Matrix: Install (Pillow) — CVE-2024-28219
Oracle Oracle Communications Risk Matrix: Install (Pillow) vulnerability
CVE: CVE-2024-28219
CVSS: 6.7
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2025 (JAN 2025)
Ubuntu
Pillow vulnerability
vendor_ubuntu·2024-04-29
CVE-2024-28219 Pillow vulnerability
Title: Pillow vulnerability
Summary: Pillow could be made to crash or run programs as an administrator
if it opened a specially crafted file.
USN-6744-1 fixed a vulnerability in Pillow. This update
provides the corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
Hugo van Kemenade discovered that Pillow was not properly performing
bounds checks when processing an ICC file, which could lead to a buffer
overflow. If a user or automated system were tricked into processing a
specially crafted ICC file, an attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Pillow vulnerability
vendor_ubuntu·2024-04-22
CVE-2024-28219 Pillow vulnerability
Title: Pillow vulnerability
Summary: Pillow could be made to crash or run programs as an administrator
if it opened a specially crafted file.
Hugo van Kemenade discovered that Pillow was not properly performing
bounds checks when processing an ICC file, which could lead to a buffer
overflow. If a user or automated system were tricked into processing a
specially crafted ICC file, an attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
Pillow vulnerability
vendor_ubuntu·2024-04-22
CVE-2024-28219 Pillow vulnerability
Title: Pillow vulnerability
Summary: Pillow could be made to crash or run programs as an administrator
if it opened a specially crafted file.
USN-6744-1 fixed a vulnerability in Pillow (Python 3). This update
provides the corresponding updates for Pillow (Python 2) in
Ubuntu 20.04 LTS.
Original advisory details:
Hugo van Kemenade discovered that Pillow was not properly performing
bounds checks when processing an ICC file, which could lead to a buffer
overflow. If a user or automated system were tricked into processing a
specially crafted ICC file, an attacker could possibly use this issue
to cause a denial of service or execute arbitrary code.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
python-pillow: buffer overflow in _imagingcms.c
vendor_redhat·2024-04-01·CVSS 6.7
CVE-2024-28219 [MEDIUM] CWE-120 python-pillow: buffer overflow in _imagingcms.c
python-pillow: buffer overflow in _imagingcms.c
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
A flaw was found in Pillow. The cms_transform_new function in src/_imagingcms.c does not validate the length of its parameters before copying them into fixed-size buffers, leading to a buffer overflow, resulting in a denial of service.
Statement: This flaw can be triggered when the ImageCms.buildTransform function is called with the InMode or OutMode arguments with a string larger than 8 bytes. An application is not vulnerable if these parameters are not controlled by the user or are validated before the function is called. Additionally, the Pillow ImageCms module functions should not be exposed to untrusted usage without input val
Debian
CVE-2024-28219: pillow - In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcp...
vendor_debian·2024·CVSS 6.7
CVE-2024-28219 [MEDIUM] CVE-2024-28219: pillow - In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcp...
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
Scope: local
bookworm: resolved (fixed in 9.4.0-1.1+deb12u1)
bullseye: resolved (fixed in 8.1.2+dfsg-0.3+deb11u2)
forky: resolved (fixed in 10.3.0-1)
sid: resolved (fixed in 10.3.0-1)
trixie: resolved (fixed in 10.3.0-1)
OSV
Pillow buffer overflow vulnerability
osv·2024-04-03
CVE-2024-28219 [HIGH] Pillow buffer overflow vulnerability
Pillow buffer overflow vulnerability
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
GHSA
Pillow buffer overflow vulnerability
ghsa·2024-04-03
CVE-2024-28219 [HIGH] CWE-120 Pillow buffer overflow vulnerability
Pillow buffer overflow vulnerability
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
OSV
CVE-2024-28219: In _imagingcms
osv·2024-04-03·CVSS 5.9
CVE-2024-28219 [MEDIUM] CVE-2024-28219: In _imagingcms
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
No detection rules found.
No public exploits indexed.
https://lists.debian.org/debian-lts-announce/2024/04/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#securityhttps://lists.debian.org/debian-lts-announce/2024/04/msg00008.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/https://lists.fedoraproject.org/archives/list/[email protected]/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
2024-04-03
Published