Published: 17/04/2014 Updated: 01/07/2017

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and previous versions and Pillow prior to 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python pillow
pythonware python imaging library

Debian Bug report logs - #737059 python-pil: CVE-2014-1932 CVE-2014-1933 Package: python-pil; Maintainer for python-pil is Matthias Klose <doko@debianorg>; Source for python-pil is src:pillow (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> Date: Wed, 29 Jan 2014 20:21:06 UTC Severity: important Tag ...

Python Imaging Library could be made to overwrite or expose files ...

The (1) load_djpeg function in JpegImagePluginpy, (2) Ghostscript function in EpsImagePluginpy, (3) load function in IptcImagePluginpy, and (4) _copy function in Imagepy in Python Image Library (PIL) 117 and earlier and Pillow before 231 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain ...

The (1) JpegImagePluginpy and (2) EpsImagePluginpy scripts in Python Image Library (PIL) 117 and earlier and Pillow before 231 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes ...

CWE-264 http://www.ubuntu.com/usn/USN-2168-1 http://www.openwall.com/lists/oss-security/2014/02/10/15 http://www.openwall.com/lists/oss-security/2014/02/11/1 https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html http://www.securityfocus.com/bid/65513 https://security.gentoo.org/glsa/201612-52 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059 https://usn.ubuntu.com/2168-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-1933

CVE-2014-1933

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect