CVE-2014-1933
First published: Thu Apr 17 2014(Updated: )
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/Pillow | <2.3.1 | 2.3.1 |
| Python Pillow | <=2.3.0 | |
| Pythonware Python Imaging Library | <=1.1.7 | |
| debian/pillow | 8.1.2+dfsg-0.3+deb11u2 9.4.0-1.1+deb12u1 10.4.0-1 | |
| <=2.3.0 | ||
| <=1.1.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2014-1933
- https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- https://security.gentoo.org/glsa/201612-52
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- http://www.openwall.com/lists/oss-security/2014/02/10/15
- http://www.openwall.com/lists/oss-security/2014/02/11/1
- http://www.securityfocus.com/bid/65513
- http://www.ubuntu.com/usn/USN-2168-1
- https://github.com/advisories/GHSA-r854-96gq-rfg3 (Advisory)
- https://security-tracker.debian.org/tracker/CVE-2014-1933
- https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml
- collector/nvd-index
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/remedy
- agent/description
- agent/first-publish-date
- collector/security-tracker-debian
- source/Debian
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r854-96gq-rfg3
- alias/CVE-2014-1933
- agent/severity
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/trending
- agent/tags
- agent/source
- vendor/python
- canonical/python pillow
- version/python pillow/2.3.0
- vendor/pythonware
- canonical/pythonware python imaging library
- version/pythonware python imaging library/1.1.7
- package-manager/debian
- package-manager/pip