CVE-2014-1932
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Exploit likelihood
What each source reports
NVD Score used
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
CVE-2014-1932- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
CVE-2014-1932- Updated
- 2026-11-02
EUVDEUVD-2014-0041 No score
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
EUVD-2014-0041- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x895-2wrm-hvp7
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
GHSA-x895-2wrm-hvp7- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-x895-2wrm-hvp7
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
GHSA-x895-2wrm-hvp7- CVSS 4.0
- 8.5 High
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSV No score
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
CVE-2014-1932- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2014-1932 No score
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
DEBIAN-CVE-2014-1932- Updated
- 2026-11-02
OSVMGASA-2014-0158 No score
Updated python-imaging package fixes insecure use of temporary files
Updated python-imaging packages fix security vulnerabilities:
Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932).
Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933).
- Record
MGASA-2014-0158- Updated
- 2026-11-02
OSVMGASA-2014-0159 No score
Updated python-pillow packages fix insecure use of temporary files
Updated python-imaging packages fix security vulnerabilities:
Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932).
Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933).
- Record
MGASA-2014-0159- Updated
- 2026-11-02
OSVPYSEC-2014-22 No score
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
- Record
PYSEC-2014-22- Updated
- 2026-11-02
OSVSUSE-SU-2015:0777-1 No score
Security update for python-Pillow
python-pillow has been updated to 2.7.0 to fix three security issues.
The following vulnerabilities have been fixed:
* CVE-2014-9601: Remote attackers could have caused a denial of service
via a compressed text chunk in a PNG image that has a large size when
it is decompressed.
* CVE-2014-3598: Remote attackers could have caused a denial of service
using specially crafted image files via Jpeg2KImagePlugin.
* CVE-2014-3589: Remote attackers could have caused a denial of service
using specially crafted image files via IcnsImagePlugin.
* CVE-2014-1932: A local user could have overwritten arbitrary files
and obtain sensitive information via a symlink attack on the
temporary file.
* CVE-2014-1933: A local user could have gained information helpful for
symlink attacks by listing process information which uses the names
of temporary files on the command line.
Security Issues:
* CVE-2014-9601
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601>
* CVE-2014-3598
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598>
* CVE-2014-3589
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589>
* CVE-2014-1932
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932>
* CVE-2014-1933
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933>
- Record
SUSE-SU-2015:0777-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
before 2.3.1 | 2.3.1 |
pillowDebian:12 |
before 2.4.0-1 | 2.4.0-1 |
pillowDebian:13 |
before 2.4.0-1 | 2.4.0-1 |
pillowDebian:14 |
before 2.4.0-1 | 2.4.0-1 |
pillowPyPI |
before 2.3.1, plus listed versions 1.01.11.21.31.4 Show 17 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.0 |
2.3.1 |
python-imagingMageia:3 |
before 1.1.7-7.1.mga3 | 1.1.7-7.1.mga3 |
python-pillowMageia:4 |
before 2.2.1-0.4.mga4 | 2.2.1-0.4.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1932 is a medium vulnerability (CVSS 4.4) in Python Pillow, published April 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in pillow 2.3.1.
References
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
security.gentoo.org/glsa/201612-52
github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
openwall.com/lists/oss-security/2014/02/11/1
ubuntu.com/usn/USN-2168-1
securityfocus.com/bid/65511
Show 19 moreShow less
lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
nvd.nist.gov/vuln/detail/CVE-2014-1932
web.archive.org/web/20170103151725/http://www.securityfocus.com/bid/65511
security-tracker.debian.org/tracker/CVE-2014-1932
advisories.mageia.org/MGASA-2014-0158.html
bugzilla.redhat.com/show_bug.cgi?id=1063658
bugs.mageia.org/show_bug.cgi?id=13075
suse.com/support/update/announcement/2015/suse-su-20150777-1
bugzilla.suse.com/921566