PT-2014-4371 · Python+1 · Pillow+2

Wiredfool · Published 2014-04-03 · Updated 2022-05-17 · CVE-2014-1932

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.3.1 Python Image Library (PIL) versions 1.1.7 and earlier

Description The issue concerns the improper creation of temporary files by certain functions in Python Image Library (PIL) and Pillow, allowing local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file. The affected functions include load djpeg in JpegImagePlugin.py, Ghostscript in EpsImagePlugin.py, load in IptcImagePlugin.py, and copy in Image.py. There is also a potential for remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

Recommendations For Pillow versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. For Python Image Library (PIL) versions 1.1.7 and earlier, consider migrating to Pillow version 2.3.1 or later, as PIL is no longer maintained. As a temporary workaround, consider restricting access to the affected functions, such as load djpeg, Ghostscript, load, and copy, until a patch is available.

Exploit

Fix

Link Following

OS Command Injection

Weakness Enumeration

CWE-59

CWE-78

Related Identifiers

CVE-2014-1932

GHSA-8M9X-PXWQ-J236

GHSA-X895-2WRM-HVP7

MGASA-2014-0158

MGASA-2014-0159

PYSEC-2014-22

PYSEC-2014-87

SUSE-SU-2014_0705-1

SUSE-SU-2015:0777-1

Affected Products

Pillow

Python Image Library

Suse

References · 28

• 🔥 https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 · Exploit
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1932 · Security Note
• https://osv.dev/vulnerability/CVE-2014-1932 · Vendor Advisory
• https://security.gentoo.org/glsa/201612-52 · Vendor Advisory
• http://ubuntu.com/usn/USN-2168-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-1932 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-87 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0159.html · Security Note
• https://osv.dev/vulnerability/GHSA-8m9x-pxwq-j236 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1932 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0158.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3007 · Security Note
• https://osv.dev/vulnerability/GHSA-x895-2wrm-hvp7 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0158 · Vendor Advisory