PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
GHSA-x895-2wrm-hvp7 · CVE-2014-1932 · PYSEC-2014-22
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2014-1932
- WEB https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- WEB https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-22.yaml
- PACKAGE https://github.com/python-pillow/Pillow
- WEB https://security.gentoo.org/glsa/201612-52
- WEB https://web.archive.org/web/20170103151725/http://www.securityfocus.com/bid/65511
- WEB http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
- WEB http://www.openwall.com/lists/oss-security/2014/02/11/1
- WEB http://www.ubuntu.com/usn/USN-2168-1
Ready to move
Start Securing
Free, no credit card | First findings in minutes