CVE-2016-10320

Advisory

Textract 1.5.0 includes a fix for CVE-2016-10320: Textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-----

* Added python 3 support, including pdfminer (`104`_ by `sirex`_ via `126`_)

* Python 3 support for ``pdfminer`` using ``pdfminer.six`` (`116`_ by
`jaraco`_ via `126`_)

* fixed security vulnerability by properly using subprocess.call (`114`_ by
`pierre-ernst`_)

* updating to ``tesseract`` 3.03 (`127`_)

* adding a ``.tif`` synonym for ``.tiff`` files (`113`_ by `onionradish`_)

* improved ``.docx`` support using ``docx2txt`` (`100`_ by `ankushshah89`_)

* several bug fixes, including:

* including all requirements for ``Pillow`` (`119`_ by `akoumjian`_)

Resources

• https://pypi.org/project/textract
• https://pyup.io/changelogs/textract/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10320
• http://seclists.org/oss-sec/2016/q4/442