PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles

MEDIUM 4.4CVE-2014-1932 · GHSA-x895-2wrm-hvp7 · PYSEC-2014-22 · Published 17/04/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
pillow PyPI	`< 2.3.1`	`2.3.1`
pillow python	`≤ 2.3.0`	No fix yet
python imaging library pythonware	`≤ 1.1.7`	No fix yet

Description

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

NVD description

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

References

nvd.nist.gov/vuln/detail/CVE-2014-1932 · ADVISORY
python-imaging/Pillow commit 4e9f367 · WEB
bugs.debian.org/cgi-bin/bugreport.cgi · WEB
pypa/advisory-database · WEB
python-pillow/Pillow · PACKAGE
security.gentoo.org/glsa/201612-52 · WEB
web.archive.org/web/20170103151725/http://www.securityfocus.com/bid/65511 · WEB
lists.opensuse.org/opensuse-updates/2014-05/msg00002.html · WEB
openwall.com/lists/oss-security/2014/02/11/1 · WEB
ubuntu.com/usn/USN-2168-1 · WEB
securityfocus.com/bid/65511
GitHub Advisory GHSA-x895-2wrm-hvp7 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free