CVE-2014-1932

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

CVSS v2.0 4.4 MEDIUM

4.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.openwall.com/lists/oss-security/2014/02/11/1
http://www.ubuntu.com/usn/USN-2168-1
https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7	Exploit Patch
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
http://www.securityfocus.com/bid/65511
https://security.gentoo.org/glsa/201612-52

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:python:pillow::::::::
	cpe:2.3:a:pythonware:python_imaging_library::::::::

Information

Published : 2014-04-17 07:55

Updated : 2017-06-30 18:29

NVD link : CVE-2014-1932

Mitre link : CVE-2014-1932

JSON object : View

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

Advertisement

Products Affected

pythonware

python_imaging_library

python

pillow

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.openwall.com/lists/oss-security/2014/02/11/1", "name": "[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp", "tags": [], "refsource": "MLIST"}, {"url": "http://www.ubuntu.com/usn/USN-2168-1", "name": "USN-2168-1", "tags": [], "refsource": "UBUNTU"}, {"url": "https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7", "name": "https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7", "tags": ["Exploit", "Patch"], "refsource": "CONFIRM"}, {"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059", "name": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059", "tags": [], "refsource": "CONFIRM"}, {"url": "http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html", "name": "openSUSE-SU-2014:0591", "tags": [], "refsource": "SUSE"}, {"url": "http://www.securityfocus.com/bid/65511", "name": "65511", "tags": [], "refsource": "BID"}, {"url": "https://security.gentoo.org/glsa/201612-52", "name": "GLSA-201612-52", "tags": [], "refsource": "GENTOO"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-59"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-1932", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.4, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-04-17T14:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.3.0"}, {"cpe23Uri": "cpe:2.3:a:pythonware:python_imaging_library:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.1.7"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-01T01:29Z"}