GitHub Advisoryadvisory · PyPI

GHSA-r854-96gq-rfg3 Pillow Temporary file name leakage

MEDIUM Published 2020-05-18 Modified 2025-04-13 Official page ↗
Aliases
CVE-2014-1933
Ecosystem
PyPI
Packages
pillow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2020-05-18

Affected packages

• PyPI pillow: < 2.3.1 → fixed in 2.3.1

Description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Related

Alias · CVE (1)

  • CVE-2014-1933 The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References