In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | RedHat | python3x-pillow-0:10.3.0-1.el8ap | * |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | RedHat | python-pillow-0:10.3.0-1.el9ap | * |
| Red Hat Enterprise Linux 8 | RedHat | python-pillow-0:5.1.1-21.el8_10 | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-pillow-0:10.3.0-1.el8pc | * |
| Red Hat Satellite 6.15 for RHEL 8 | RedHat | python-pillow-0:10.3.0-1.el8pc | * |
| Pillow | Ubuntu | esm-infra/bionic | * |
| Pillow | Ubuntu | esm-infra/xenial | * |
| Pillow | Ubuntu | focal | * |
| Pillow | Ubuntu | jammy | * |
| Pillow | Ubuntu | mantic | * |
| Pillow | Ubuntu | noble | * |
| Pillow | Ubuntu | trusty/esm | * |
| Pillow | Ubuntu | upstream | * |
| Pillow-python2 | Ubuntu | esm-apps/focal | * |
| Pillow-python2 | Ubuntu | focal | * |