Pillow command injection

CRITICAL 10.0CVE-2014-3007 · GHSA-8m9x-pxwq-j236 · PYSEC-2014-87 · Published 27/04/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 2.5.0`	`2.5.0`
pillow python	`= 2.3.0`	No fix yet
python imaging library pythonware	`≤ 1.1.7`	No fix yet

Description

Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

NVD description

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

References

nvd.nist.gov/vuln/detail/CVE-2014-3007 · ADVISORY
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html · WEB
GitHub Advisory GHSA-8m9x-pxwq-j236 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free