p PatchFirst

CVE-2014-1933

CVE-2014-1933

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

CVSS 5.1 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • pillow Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.0-1

    Update to 2.4.0-1

  • pillow PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.7.8
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    Affected ranges
    • ECOSYSTEM: < 2.3.1

    Update to 2.3.1

  • pillow PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7.0
    • 1.7.1
    • 1.7.2
    • 1.7.3
    • 1.7.4
    • 1.7.5
    • 1.7.6
    • 1.7.7
    • 1.7.8
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.3.0
    Affected ranges
    • GIT: < 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
    • ECOSYSTEM: < 2.3.1

    Update to 2.3.1

Original sources

Check your server →