CVE-2014-3007: OS Command Injection
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Other sources
Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/pillowto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3007?
CVE-2014-3007 is classified as a high severity vulnerability due to the potential for remote command execution.
How do I fix CVE-2014-3007?
To fix CVE-2014-3007, you should upgrade Pillow to version 2.5.0 or later, or ensure you are using a non-vulnerable version of the Python Imaging Library.
What software versions are affected by CVE-2014-3007?
CVE-2014-3007 affects Python Image Library (PIL) versions up to 1.1.7 and Pillow versions up to 2.3.
Can CVE-2014-3007 be exploited remotely?
Yes, CVE-2014-3007 can be exploited remotely by attackers through shell metacharacters.
What type of attacks can CVE-2014-3007 enable?
CVE-2014-3007 can enable attackers to execute arbitrary commands on affected systems.