CVE-2014-3007 in Python Imaging Library

Résumé

par MITRE

Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Réserver: 27/04/2014
• Divulgation: 27/04/2014
• Modérer: accepté
• Entrée: VDB-69498
• CPE: prêt
• CWE: CWE-78 (confirmé)
• CVSS: 10.0 (NVD)
• EPSS: 0.12055
• KEV: non
• Activités: très faible
• Secteur: Finance, Hospital, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-3007
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-3007
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-3007/