PT-2014-4372 · Python+1 · Pillow+2

Wiredfool · Published 2014-04-03 · Updated 2020-05-18 · CVE-2014-1933

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 2.3.1 Python Image Library (PIL) versions 1.1.7 and earlier

Description The issue in the JpegImagePlugin.py and EpsImagePlugin.py scripts makes it easier for local users to conduct symlink attacks by listing the processes. This is due to the scripts using the names of temporary files on the command line.

Recommendations For Pillow versions prior to 2.3.1, update to version 2.3.1 or later to resolve the issue. For Python Image Library (PIL) versions 1.1.7 and earlier, consider upgrading to Pillow, as PIL is no longer maintained, and then update to version 2.3.1 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-264

Related Identifiers

CVE-2014-1933

GHSA-R854-96GQ-RFG3

MGASA-2014-0158

MGASA-2014-0159

PYSEC-2014-23

SUSE-SU-2015:0777-1

Affected Products

Pillow

Python Image Library

Suse

References · 24

• 🔥 https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 · Exploit
• https://security.gentoo.org/glsa/201612-52 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-1933 · Security Note
• https://osv.dev/vulnerability/CVE-2014-1933 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-1933 · Vendor Advisory
• http://ubuntu.com/usn/USN-2168-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0159 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r854-96gq-rfg3 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0158.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-1933 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0159.html · Security Note
• https://osv.dev/vulnerability/PYSEC-2014-23 · Vendor Advisory
• https://github.com/python-imaging/Pillow · Note