id: PYSEC-2014-23
details: The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image
  Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary
  files on the command line, which makes it easier for local users to conduct symlink
  attacks by listing the processes.
affected:
- package:
    name: pillow
    ecosystem: PyPI
    purl: pkg:pypi/pillow
  ranges:
  - type: GIT
    repo: https://github.com/python-imaging/Pillow
    events:
    - introduced: '0'
    - fixed: 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 2.3.1
  versions:
  - '1.0'
  - '1.1'
  - '1.2'
  - '1.3'
  - '1.4'
  - '1.5'
  - '1.6'
  - 1.7.0
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.4
  - 1.7.5
  - 1.7.6
  - 1.7.7
  - 1.7.8
  - 2.0.0
  - 2.1.0
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.3.0
references:
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-2168-1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/02/10/15
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/02/11/1
- type: FIX
  url: https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- type: WEB
  url: http://www.securityfocus.com/bid/65513
- type: ADVISORY
  url: https://security.gentoo.org/glsa/201612-52
- type: ADVISORY
  url: https://github.com/advisories/GHSA-r854-96gq-rfg3
aliases:
- CVE-2014-1933
- GHSA-r854-96gq-rfg3
modified: '2021-07-15T02:22:17.008543Z'
published: '2014-04-17T14:55:00Z'