PT-2014-5016 · Python · Pillow+1

Published 2014-04-27 · Updated 2022-05-17 · CVE-2014-3007

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.5.0 Python Image Library (PIL) versions 1.1.7 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors, possibly related to JpegImagePlugin.py.

Recommendations For Pillow versions prior to 2.5.0, update to version 2.5.0 or later. For Python Image Library (PIL) versions 1.1.7 and earlier, consider migrating to Pillow version 2.5.0 or later as a mitigation measure.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2014-3007

GHSA-8M9X-PXWQ-J236

MGASA-2014-0476

PYSEC-2014-87

USN-2168-1

Affected Products

Pillow

Python Image Library

References · 18

• https://osv.dev/vulnerability/MGASA-2014-0476 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3007 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3007 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0476.html · Security Note
• https://ubuntu.com/security/CVE-2014-3007 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-87 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3007 · Security Note
• https://osv.dev/vulnerability/GHSA-8m9x-pxwq-j236 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2168-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3007 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3007 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3007 · Vendor Advisory
• https://github.com/python-pillow/Pillow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 · Note