CVE-2014-3007
Pillow command injection
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Exploit likelihood
What each source reports
NVD Score used
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
CVE-2014-3007- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
CVE-2014-3007- Updated
- 2026-11-02
EUVDEUVD-2014-0043 No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
EUVD-2014-0043- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8m9x-pxwq-j236
Pillow command injection
Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
GHSA-8m9x-pxwq-j236- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-8m9x-pxwq-j236
Pillow command injection
Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
GHSA-8m9x-pxwq-j236- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSV No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
CVE-2014-3007- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-3007 No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
DEBIAN-CVE-2014-3007- Updated
- 2026-11-02
OSVMGASA-2014-0476 No score
Updated python-imaging and python-pillow packages fix security vulnerability
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters, due to an incomplete fix for CVE-2014-1932 (CVE-2014-3007).
- Record
MGASA-2014-0476- Updated
- 2026-11-02
OSVPYSEC-2014-87 No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
PYSEC-2014-87- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3007 No score
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
- Record
UBUNTU-CVE-2014-3007- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
before 2.5.0 | 2.5.0 |
pillowDebian:12 |
before 2.4.0-1 | 2.4.0-1 |
pillowDebian:13 |
before 2.4.0-1 | 2.4.0-1 |
pillowDebian:14 |
before 2.4.0-1 | 2.4.0-1 |
pillowPyPI |
before 2.5.0, plus listed versions 1.01.11.21.31.4 Show 20 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.0 |
2.5.0 |
python-imagingMageia:3 |
before 1.1.7-7.3.mga3 | 1.1.7-7.3.mga3 |
python-pillowMageia:4 |
before 2.2.1-0.6.mga4 | 2.2.1-0.6.mga4 |
pillowUbuntu:14.04:LTS |
before 2.3.0-1ubuntu3, plus listed versions 2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu42.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu2 |
2.3.0-1ubuntu3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3007 is a high vulnerability (CVSS 10.0) in Python Pillow, published April 27, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 10.4%, the 95th percentile. Fixed in pillow 2.5.0.
References
people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-1932.html
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
nvd.nist.gov/vuln/detail/CVE-2014-3007
github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-87.yaml
security-tracker.debian.org/tracker/CVE-2014-3007