CVE-2014-1933: Pillow Temporary file name leakage – CVSS 2.1 · Watchpost

← All vulnerabilities

Pillow Temporary file name leakage

FAIBLE 2.1CVE-2014-1933 · GHSA-r854-96gq-rfg3 · PYSEC-2014-23 · Published 17/04/2014 · updated 17/06/2026

En bref

CVE-2014-1933 est une vulnérabilité FAIBLE (CVSS 2.1) touchant pillow, pillow (python), python imaging library (pythonware).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.45%, plus élevée que 39.2% des vulnérabilités.
Correctif : mettre à jour vers 2.3.1 ou plus récent.

Package	Affected versions	Patched versions
pillow PyPI	`< 2.3.1`	`2.3.1`
pillow python	`≤ 2.3.0`	No fix yet
python imaging library pythonware	`≤ 1.1.7`	No fix yet

Description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

NVD description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

References

nvd.nist.gov/vuln/detail/CVE-2014-1933 · ADVISORY
python-imaging/Pillow commit 4e9f367 · WEB
pypa/advisory-database · WEB
python-imaging/Pillow · PACKAGE
security.gentoo.org/glsa/201612-52 · WEB
lists.opensuse.org/opensuse-updates/2014-05/msg00002.html · WEB
openwall.com/lists/oss-security/2014/02/10/15 · WEB
openwall.com/lists/oss-security/2014/02/11/1 · WEB
ubuntu.com/usn/USN-2168-1 · WEB
securityfocus.com/bid/65513
GitHub Advisory GHSA-r854-96gq-rfg3 · ADVISORY

Autres vulnérabilités de pillow

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free