critical9.8
CVE-2014-3007
Pillow command injection
Impact
Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | pillow | < 2.5.0 | 2.5.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Python | Pillow | Version 2.3.0 |
| Pythonware | Python Imaging Library | through 1.1.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
- https://github.com/advisories/GHSA-8m9x-pxwq-j236
- https://nvd.nist.gov/vuln/detail/CVE-2014-3007
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml