id: PYSEC-2014-22
details: The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function
  in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function
  in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1
  do not properly create temporary files, which allow local users to overwrite arbitrary
  files and obtain sensitive information via a symlink attack on the temporary file.
affected:
- package:
    name: pillow
    ecosystem: PyPI
    purl: pkg:pypi/pillow
  ranges:
  - type: GIT
    repo: https://github.com/python-imaging/Pillow
    events:
    - introduced: "0"
    - fixed: 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.3.1
  versions:
  - "1.0"
  - "1.1"
  - "1.2"
  - "1.3"
  - "1.4"
  - "1.5"
  - "1.6"
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 2.0.0
  - 2.1.0
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.3.0
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/02/11/1
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-2168-1
- type: FIX
  url: 
    https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- type: WEB
  url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- type: WEB
  url: http://www.securityfocus.com/bid/65511
- type: ADVISORY
  url: https://security.gentoo.org/glsa/201612-52
- type: ADVISORY
  url: https://github.com/advisories/GHSA-x895-2wrm-hvp7
aliases:
- CVE-2014-1932
- GHSA-x895-2wrm-hvp7
modified: "2021-07-15T02:22:16.928376Z"
published: "2014-04-17T14:55:00Z"