CVE-2014-1932

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy…

published April 17, 2014

CVSS
—
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00496 · 41.3th percentile
Published
2014-04-17T14:00Z
EPSS history
Timeline
  • 17 APR 14:00Z
    The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy…
    cvelistv5