CVE-2014-3007
NoneCVSS
—
EPSS
10.4%
Published
Apr 27, 2014
CISA due date
—
The record
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | pillow | 0 | 2.5.0 |
| Debian:11 | pillow | 0 | 2.4.0-1 |
| Debian:12 | pillow | 0 | 2.4.0-1 |
| Debian:13 | pillow | 0 | 2.4.0-1 |
| Mageia:3 | python-imaging | 0 | 1.1.7-7.3.mga3 |
| Mageia:4 | python-pillow | 0 | 2.2.1-0.6.mga4 |
| Ubuntu:14.04:LTS | pillow | 0 | 2.3.0-1ubuntu3 |
Related vulnerabilities
- CVE-2026-25990 Pillow is a Python imaging library. Also affects pillow
- CVE-2025-48379 Pillow is a Python imaging library. Also affects pillow
- CVE-2024-28219 In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used… Also affects pillow
- GHSA-4fx9-vc88-q2xc Infinite loop in Pillow Also affects pillow
- GHSA-jgpv-4h4c-xhw3 Uncontrolled Resource Consumption in pillow Also affects pillow
- CVE-2016-3076 Heap-based buffer overflow in the j2k_encode_entry function in Pillow 2.5.0 through 3.1.1… Also affects pillow
- CVE-2016-9190 Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using… Also affects pillow
- CVE-2016-9189 Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by… Also affects pillow