CVE-2014-3007

2014-04-2700:00:00

ubuntu.com

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.003 Low

EPSS

Percentile

65.3%

JSON

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow
remote attackers to execute arbitrary commands via shell metacharacters in
unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

Bugs

<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059>

Notes

Author	Note
mdeslaur	fixed at the same time as CVE-2014-1932 and CVE-2014-1933

OSVersionArchitecturePackageVersionFilename
ubuntu14.04noarchpillow< 2.3.0-1ubuntu3UNKNOWN
ubuntu10.04noarchpython-imaging< 1.1.7-1ubuntu0.2UNKNOWN
ubuntu12.04noarchpython-imaging< 1.1.7-4ubuntu0.12.04.1UNKNOWN
ubuntu12.10noarchpython-imaging< 1.1.7-4ubuntu0.12.10.1UNKNOWN
ubuntu13.10noarchpython-imaging< 1.1.7+2.0.0-1ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	14.04	noarch	pillow	< 2.3.0-1ubuntu3	UNKNOWN
ubuntu	10.04	noarch	python-imaging	< 1.1.7-1ubuntu0.2	UNKNOWN
ubuntu	12.04	noarch	python-imaging	< 1.1.7-4ubuntu0.12.04.1	UNKNOWN
ubuntu	12.10	noarch	python-imaging	< 1.1.7-4ubuntu0.12.10.1	UNKNOWN
ubuntu	13.10	noarch	python-imaging	< 1.1.7+2.0.0-1ubuntu1.1	UNKNOWN