p PatchFirst

CVE-2014-3007

CVE-2014-3007

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

CVSS 9.8 · Critical · EPSS 10.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • pillow Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.7.8
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    • 2.3.1
    • 2.3.2
    • 2.4.0
    Affected ranges
    • ECOSYSTEM: < 2.5.0

    Update to 2.5.0

  • pillow Ubuntu:14.04:LTS

    Versions
    • 2.2.1-1ubuntu2
    • 2.2.1-2ubuntu1
    • 2.2.1-3ubuntu2
    • 2.2.1-3ubuntu3
    • 2.2.1-3ubuntu4
    • 2.2.1-3ubuntu6
    • 2.3.0-1ubuntu1
    • 2.3.0-1ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.3.0-1ubuntu3

    Update to 2.3.0-1ubuntu3

Original sources

Check your server →