VulnerabilityModified
CVE-2014-1933
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks…
LOW 2.1EPSS 0.45%
Does this matter?
Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.
Description
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
- CVSS 2.0
- 2.1 LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- python/pillow · pythonware/python imaging library
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- http://www.openwall.com/lists/oss-security/2014/02/10/15
- http://www.openwall.com/lists/oss-security/2014/02/11/1
- http://www.securityfocus.com/bid/65513
- http://www.ubuntu.com/usn/USN-2168-1
- https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7Exploit, Patch
- https://security.gentoo.org/glsa/201612-52
- http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- http://www.openwall.com/lists/oss-security/2014/02/10/15
- http://www.openwall.com/lists/oss-security/2014/02/11/1
- http://www.securityfocus.com/bid/65513
- http://www.ubuntu.com/usn/USN-2168-1
- https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7Exploit, Patch
- https://security.gentoo.org/glsa/201612-52
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.