CVE-2014-3007

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
Affected Products (NVD)
VendorProductVersion
pythonpillow
2.3.0
pythonwarepython_imaging_library
𝑥
≤ 1.1.7
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pillow
bookworm
9.4.0-1.1+deb12u1
fixed
bookworm (security)
9.4.0-1.1+deb12u1
fixed
bullseye
8.1.2+dfsg-0.3+deb11u2
fixed
bullseye (security)
8.1.2+dfsg-0.3+deb11u2
fixed
sid
10.4.0-1
fixed
squeeze
no-dsa
trixie
10.4.0-1
fixed
wheezy
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pillow
lucid
dne
precise
dne
quantal
dne
saucy
dne
trusty
Fixed 2.3.0-1ubuntu3
released
python-imaging
lucid
Fixed 1.1.7-1ubuntu0.2
released
precise
Fixed 1.1.7-4ubuntu0.12.04.1
released
quantal
Fixed 1.1.7-4ubuntu0.12.10.1
released
saucy
Fixed 1.1.7+2.0.0-1ubuntu1.1
released
trusty
dne
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python-pillow
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
python-pillow-debuginfo
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
python-pillow-devel
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
python-pillow-doc
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
python-pillow-sane
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
python-pillow-tk
Amazon Linux 2
0:2.0.0-23.gitd1c6db8.amzn2.0.8
fixed
Common Weakness Enumeration
References
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059