CVE-2024-28219: debian debian_linux Integer Overflow to Buffer Overflow
Modified
AliasesSUSE-SU-2024:1258-1SUSE-SU-2024:1267-1SUSE-SU-2024:1268-1GHSA-44wm-f244-xhp3BIT-pillow-2024-28219PYSEC-2026-1793RHSA-2024:4227UBUNTU-CVE-2024-28219USN-6744-1USN-6744-2USN-6744-3DEBIAN-CVE-2024-28219DLA-3786-1CGA-24w8-mvw7-873hCGA-2fqf-8pw8-xm89CGA-4f82-wgpg-gw9jCGA-574p-6xjq-w8w4CGA-778h-mr9j-5625CGA-7j9h-gqjp-g25wCGA-929r-8j6p-wmxcCGA-gqfx-g2vj-885jCGA-j837-6mmm-6rqmCGA-jc6q-663j-rxrwCGA-mgc9-r5cm-vxq4CGA-mw7c-v26m-hqfxCGA-pf77-5wcm-8prjCGA-qcww-prfw-c986CGA-qfmc-h957-2xr6SUSE-SU-2024:1154-1ALPINE-CVE-2024-28219
Published 03-04-2024Last modified 04-11-2025
Vulnerability summary
CVE-2024-28219 is a medium (CVSS 6.7) Integer Overflow to Buffer Overflow vulnerability in debian debian_linux. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 6.7, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
6.7/10
010
Medium · v3.1 (CVE.org)EPSS score
1.00%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 6 · Related 7Timeline
- 03-04-2024PublishedVulnerability first disclosed.
- 04-11-2025Last modifiedVulnerability information updated.
Description
In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.
CVSS metrics
10 scores · 9 sources · 2 versionsHigh 7.3Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesSingle source
Medium 6.7Preferred score · CVE.org (CNA)
CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:RSources9 sources · 5.9–6.7
- OSV · PypiEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated6.7MediumCVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R
- OSV · ChainguardEcosystem advisory · calculated6.7MediumCVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:R
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.00% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Suse13 products
- python-Pillow&distro=HPE Helion OpenStack 8< 4.2.1-3.29.2
- python-Pillow&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 9.5.0-150400.5.15.1
- python-Pillow&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 9.5.0-150400.5.15.1
- python-Pillow&distro=SUSE Linux Enterprise Module for Python 3 15 SP5< 9.5.0-150400.5.15.1
- python-Pillow&distro=SUSE Linux Enterprise Server 15 SP4-LTSS< 9.5.0-150400.5.15.1
Redhat9 products
- python-pillow< 0:5.1.1-21.el8_10
- python-pillow-debuginfo< 0:5.1.1-21.el8_10
- python-pillow-debugsource< 0:5.1.1-21.el8_10
- python3-pillow< 0:5.1.1-21.el8_10
- python3-pillow-debuginfo< 0:5.1.1-21.el8_10
Chainguard8 products
- kubeflow-pipelines-visualization-server< 2.2.0-r0
- py3-pillow< 10.3.0-r0
- py3-seaborn< 0.13.2-r3
- py3-supported-seaborn< 0.13.2-r3
- py3.10-seaborn< 0.13.2-r3
Wolfi8 products
- kubeflow-pipelines-visualization-server< 2.2.0-r0
- py3-pillow< 10.3.0-r0
- py3-seaborn< 0.13.2-r3
- py3-supported-seaborn< 0.13.2-r3
- py3.10-seaborn< 0.13.2-r3
Debian2 products
- pillow< 5.4.1-2+deb10u6 | < 9.4.0-1.1+deb12u1 | < 10.3.0-1
- debian_linuxEOL10.0
Ubuntu2 products
- pillow< 2.3.0-1ubuntu3.4+esm4 | < 3.1.2-0ubuntu1.6+esm2 | < 5.1.0-1ubuntu0.8+esm1 | < 7.0.0-4ubuntu0.9 | < 9.0.1-1ubuntu0.3 | < 10.2.0-1ubuntu1
- pillow-python2< 6.2.1-3ubuntu0.1~esm2
Alpine1 product
- py3-pillow< 10.3.0-r0
Opensuse1 product
- python-Pillow&distro=openSUSE Leap 15.5< 7.2.0-150300.3.9.1 | < 9.5.0-150400.5.15.1
PyPI1 product
- pillow< 10.3.0
Python1 product
- pillow< 10.3.0
10 vendors · 46 products
References
30 links
lists.debian.org/debian-lts-announce/2024/04/msg00008.htmlMailing ListWEBARTICLEThird Party Advisory
Show all 30 references
- pypi.org/project/pillowPACKAGE