{"id":"CVE-2014-1932","url":"https://www.cyber-defence.io/tools/cve/CVE-2014-1932","generatedAt":"2026-10-27T18:47:34.407Z","title":"The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not…","description":"The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.","published":"2014-04-17T14:55:11.000Z","lastModified":"2026-06-17T00:05:46.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"2.0","score":4.4,"severity":"MEDIUM","vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P"},"cwe":["CWE-59"],"affected":["python/pillow","pythonware/python imaging library"],"epss":{"score":0.00496,"percentile":0.42259,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.50%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","source":"cve@mitre.org"},{"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","source":"cve@mitre.org"},{"url":"http://www.securityfocus.com/bid/65511","source":"cve@mitre.org"},{"url":"http://www.ubuntu.com/usn/USN-2168-1","source":"cve@mitre.org"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059","source":"cve@mitre.org"},{"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","tags":["Exploit","Patch"],"source":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/201612-52","source":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.securityfocus.com/bid/65511","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.ubuntu.com/usn/USN-2168-1","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","tags":["Exploit","Patch"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/201612-52","source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-1932","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}