In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
Weakness
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pillow | Python | * | 10.3.0 (excluding) |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | RedHat | python3x-pillow-0:10.3.0-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | RedHat | python-pillow-0:10.3.0-1.el9ap | * |
| Red Hat Enterprise Linux 8 | RedHat | python-pillow-0:5.1.1-21.el8_10 | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-pillow-0:10.3.0-1.el8pc | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-pillow-0:10.3.0-1.el8pc | * |
| Pillow | Ubuntu | esm-infra-legacy/trusty | * |
| Pillow | Ubuntu | esm-infra/bionic | * |
| Pillow | Ubuntu | esm-infra/focal | * |
| Pillow | Ubuntu | esm-infra/xenial | * |
| Pillow | Ubuntu | focal | * |
| Pillow | Ubuntu | jammy | * |
| Pillow | Ubuntu | mantic | * |
| Pillow | Ubuntu | noble | * |
| Pillow | Ubuntu | trusty/esm | * |
| Pillow | Ubuntu | upstream | * |
| Pillow-python2 | Ubuntu | esm-apps/focal | * |
| Pillow-python2 | Ubuntu | focal | * |
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/10.html
- https://cwe.mitre.org/data/definitions/100.html
- https://cwe.mitre.org/data/definitions/14.html
- https://cwe.mitre.org/data/definitions/24.html
- https://cwe.mitre.org/data/definitions/45.html
- https://cwe.mitre.org/data/definitions/46.html
- https://cwe.mitre.org/data/definitions/47.html
- https://cwe.mitre.org/data/definitions/67.html
- https://cwe.mitre.org/data/definitions/8.html
- https://cwe.mitre.org/data/definitions/9.html
- https://cwe.mitre.org/data/definitions/92.html
References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
- https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security
- https://lists.debian.org/debian-lts-announce/2024/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XLPUT3VK4GQ6EVY525TT2QNUIXNRU5M/
- https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html#security