CVE-2014-1933

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Updated python-imaging packages fix security vulnerabilities:

Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932).

Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933).

Updated python-imaging packages fix security vulnerabilities:

Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932).

Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933).

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

python-pillow has been updated to 2.7.0 to fix three security issues.

The following vulnerabilities have been fixed:

* CVE-2014-9601: Remote attackers could have caused a denial of service
  via a compressed text chunk in a PNG image that has a large size when
  it is decompressed.
* CVE-2014-3598: Remote attackers could have caused a denial of service
  using specially crafted image files via Jpeg2KImagePlugin.
* CVE-2014-3589: Remote attackers could have caused a denial of service
  using specially crafted image files via IcnsImagePlugin.
* CVE-2014-1932: A local user could have overwritten arbitrary files
  and obtain sensitive information via a symlink attack on the
  temporary file.
* CVE-2014-1933: A local user could have gained information helpful for
  symlink attacks by listing process information which uses the names
  of temporary files on the command line.

Security Issues:

* CVE-2014-9601
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601>
* CVE-2014-3598
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598>
* CVE-2014-3589
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589>
* CVE-2014-1932
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932>
* CVE-2014-1933
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933>