From 7c7ab8ad4e2269d73fa6a572a7222aca3fdee27d Mon Sep 17 00:00:00 2001 From: Soumya Sambu Date: Fri, 7 Nov 2025 17:04:28 +0530 Subject: python3-pillow: Fix CVE-2024-28219 In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28219 https://security-tracker.debian.org/tracker/CVE-2024-28219 Upstream patch: https://github.com/python-pillow/Pillow/commit/2a93aba5cfcf6e241ab4f9392c13e3b74032c061 Signed-off-by: Soumya Sambu Signed-off-by: Gyorgy Sarvari --- meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb') diff --git a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb index e42e58be80..ffc2c00fb1 100644 --- a/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb +++ b/meta-python/recipes-devtools/python/python3-pillow_9.4.0.bb @@ -14,6 +14,7 @@ SRC_URI = "git://github.com/python-pillow/Pillow.git;branch=main;protocol=https file://CVE-2023-50447-2.patch \ file://CVE-2023-50447-3.patch \ file://CVE-2023-50447-4.patch \ + file://CVE-2024-28219.patch \ " SRCREV ?= "82541b6dec8452cb612067fcebba1c5a1a2bfdc8" -- cgit v1.2.3-54-g00ecf