PT-2014-5016 · Python · Pillow+1

Publicado 2014-04-27 · Atualizado 2022-05-17 · CVE-2014-3007

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.5.0 Python Image Library (PIL) versions 1.1.7 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors, possibly related to JpegImagePlugin.py.

Recommendations For Pillow versions prior to 2.5.0, update to version 2.5.0 or later. For Python Image Library (PIL) versions 1.1.7 and earlier, consider migrating to Pillow version 2.5.0 or later as a mitigation measure.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2014-3007

GHSA-8M9X-PXWQ-J236

MGASA-2014-0476

PYSEC-2014-87

USN-2168-1

Produtos afetados

Pillow

Python Image Library

Referências · 18

• https://github.com/python-pillow/Pillow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml · Nota
• https://osv.dev/vulnerability/MGASA-2014-0476 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3007 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3007 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0476.html · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=1094101 · Nota
• https://ubuntu.com/security/CVE-2014-3007 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2014-87 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-3007 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8m9x-pxwq-j236 · Aviso do Fabricante
• http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html · Nota
• https://ubuntu.com/security/notices/USN-2168-1 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=14580 · Nota