Skip to content

Vendor

pythonware vulnerabilities

3 published CVES affecting pythonware, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
1
Low
1
Unscored
0
CISA KEV
0
Atom feed of pythonware alerts

Products

Latest pythonware CVEs

Newest publication first

  1. CVE-2014-3007 Pillow command injection

    Published
    HighCVSS 10.0 EPSS 10.4%

    Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.

  2. CVE-2014-1932 PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles

    Published
    MediumCVSS 4.4 EPSS 0.50%

    The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary f...

  3. CVE-2014-1933 Pillow Temporary file name leakage

    Published
    LowCVSS 2.1 EPSS 0.45%

    The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.