Published: 17/04/2014 Updated: 01/07/2017

CVSS v2 Base Score: 4.4 | Impact Score: 6.4 | Exploitability Score: 3.4

VMScore: 392

Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and previous versions and Pillow prior to 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python pillow
pythonware python imaging library

Debian Bug report logs - #737059 python-pil: CVE-2014-1932 CVE-2014-1933 Package: python-pil; Maintainer for python-pil is Matthias Klose <doko@debianorg>; Source for python-pil is src:pillow (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> Date: Wed, 29 Jan 2014 20:21:06 UTC Severity: important Tag ...

Python Imaging Library could be made to overwrite or expose files ...

The (1) load_djpeg function in JpegImagePluginpy, (2) Ghostscript function in EpsImagePluginpy, (3) load function in IptcImagePluginpy, and (4) _copy function in Imagepy in Python Image Library (PIL) 117 and earlier and Pillow before 231 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain ...

CWE-59 http://www.openwall.com/lists/oss-security/2014/02/11/1 http://www.ubuntu.com/usn/USN-2168-1 https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html http://www.securityfocus.com/bid/65511 https://security.gentoo.org/glsa/201612-52 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 https://usn.ubuntu.com/2168-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-1932

CVE-2014-1932

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect