GHSA-8m9x-pxwq-j236

Pillow command injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2014-3007

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	pillow	< 2.5.0	2.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-3007 advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 web
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml web
https://github.com/python-pillow/Pillow package
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html web