PT-2014-4372 · Python+1 · Pillow+2

Wiredfool · Publicado 2014-04-03 · Atualizado 2020-05-18 · CVE-2014-1933

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.3.1 Python Image Library (PIL) versions 1.1.7 and earlier

Description The issue in the JpegImagePlugin.py and EpsImagePlugin.py scripts makes it easier for local users to conduct symlink attacks by listing the processes. This is due to the scripts using the names of temporary files on the command line.

Recommendations For Pillow versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. For Python Image Library (PIL) versions 1.1.7 and earlier, consider upgrading to Pillow, as PIL is no longer maintained, and then update to version 2.3.1 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-264

Identificadores relacionados

CVE-2014-1933

GHSA-R854-96GQ-RFG3

MGASA-2014-0158

MGASA-2014-0159

PYSEC-2014-23

SUSE-SU-2015:0777-1

Produtos afetados

Pillow

Python Image Library

Suse

Referências · 24

• 🔥 https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 · Exploit
• https://github.com/python-imaging/Pillow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml · Nota
• https://security.gentoo.org/glsa/201612-52 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1063658 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0158 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-1933 · Nota de Segurança
• http://securityfocus.com/bid/65513 · Nota
• https://osv.dev/vulnerability/CVE-2014-1933 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1933 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2168-1 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1063660 · Nota
• https://osv.dev/vulnerability/MGASA-2014-0159 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/02/10/15 · Nota
• https://osv.dev/vulnerability/GHSA-r854-96gq-rfg3 · Aviso do Fabricante