Pillow command injection

심각 10.0CVE-2014-3007 · GHSA-8m9x-pxwq-j236 · PYSEC-2014-87 · Published 27/04/2014 · updated 17/06/2026

요약

CVE-2014-3007은(는) pillow, pillow (python), python imaging library (pythonware)에 영향을 주는 심각 (CVSS 10.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 10.4%, 전체 취약점의 95.7%보다 높음.
조치: 2.5.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
pillow PyPI	`< 2.5.0`	`2.5.0`
pillow python	`= 2.3.0`	No fix yet
python imaging library pythonware	`≤ 1.1.7`	No fix yet

Description

Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

NVD description

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.