p PatchFirst

CVE-2014-1932

CVE-2014-1932

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

CVSS 8.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • pillow Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.7.8
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    Affected ranges
    • ECOSYSTEM: < 2.3.1

    Update to 2.3.1

  • pillow PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.7.8
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    Affected ranges
    • GIT: < 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
    • ECOSYSTEM: < 2.3.1

    Update to 2.3.1

Original sources

Check your server →