Description
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.4.0-1 | — |
| Debian 13 | pillow | 2.4.0-1 | — |
| Debian 12 | pillow | 2.4.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | pillow | 2.3.0-1ubuntu3 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-pillow +4 | 2.0.0-23.gitd1c6db8.amzn2.0.8 | ALAS2-2023-2286 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.5.0 | 2.5.0 | GHSA-8m9x-pxwq-j236 |
Advisories 1
- ALAS2-2023-2286 Important: python-pillow security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 5, 2023