Medium ALAS2023-2024-767 1 CVE

Moderate: python-pillow security update (Amazon Linux 2023)

Published Nov 13, 2024 · Updated Nov 14, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-28219: In _imagingcms.c, two strcpy calls were able to copy too much data into fixed length strings. This has been fixed by using strncpy instead.

Fixed packages 7

Release	Package	Fixed in
Amazon Linux · 2023	python-pillow-debuginfo	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python-pillow-debugsource	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python3-pillow	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python3-pillow-debuginfo	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python3-pillow-devel	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python3-pillow-tk	0:9.4.0-2.amzn2023.0.6
Amazon Linux · 2023	python3-pillow-tk-debuginfo	0:9.4.0-2.amzn2023.0.6

Vulnerabilities 1

Medium 6.7

CVE-2024-28219

Pillow buffer overflow vulnerability

In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.

kubeflow-pipelines-visualization-server pillow pillow pillow Debian Ubuntu Alpine Wolfi PyPI

Apr 3, 2024

References

web
https://alas.aws.amazon.com/cve/html/CVE-2024-28219.html