GHSA-r854-96gq-rfg3

Pillow Temporary file name leakage

En bref

Publiée: 2020-05-18 17:41 UTC
Mise à jour: 2025-04-13 23:36 UTC
CVE: CVE-2014-1933
Alias: PYSEC-2014-23
CVSS_V3: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS_V4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Paquets affectés

Paquet	Versions
PyPI · pillow	introduced 0, fixed 2.3.1

Références

https://nvd.nist.gov/vuln/detail/CVE-2014-1933 ADVISORY
https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 WEB
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml WEB
https://github.com/python-imaging/Pillow PACKAGE
https://security.gentoo.org/glsa/201612-52 WEB
http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html WEB
http://www.openwall.com/lists/oss-security/2014/02/10/15 WEB
http://www.openwall.com/lists/oss-security/2014/02/11/1 WEB
http://www.ubuntu.com/usn/USN-2168-1 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database