{"id":"CVE-2014-1933","aliases":["DEBIAN-CVE-2014-1933","EUVD-2014-0042","GHSA-r854-96gq-rfg3","MGASA-2014-0158","MGASA-2014-0159","PYSEC-2014-23","SUSE-SU-2015:0777-1"],"status":"published","title":"Pillow Temporary file name leakage","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00451,"percentile":0.39477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-264"],"published":"2014-04-03T15:18:48Z","modified":"2026-10-23T15:47:35Z","fixes":[{"ecosystem":"PyPI","package":"pillow","fixed_in":["2.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"pillow","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"pillow","fixed_in":["2.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"pillow","fixed_in":["2.4.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0"]},{"source":"osv","ecosystem":"Mageia:3","package":"python-imaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.7-7.1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"python-pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-0.4.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"pillow","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}],"versions":["1.0","1.1","1.2","1.3","1.4","1.5","1.6","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","2.0.0","2.1.0","2.2.0","2.2.1","2.2.2","2.3.0"]}],"products":[{"vendor":"python","product":"pillow"},{"vendor":"pythonware","product":"python_imaging_library"}],"references":[{"url":"https://security.gentoo.org/glsa/201612-52","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/02/10/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2168-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/65513","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1933","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r854-96gq-rfg3","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1933","tags":["advisory"]},{"url":"https://github.com/python-imaging/Pillow","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2014-0158.html","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063660","tags":["report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13075","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0159.html","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150777-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/921566","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-1933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9601","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-1933","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T09:58:15.513Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-0042","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:00:00Z","modified":"2024-08-06T09:58:15Z","updated_at":"2026-11-03T01:57:16.268492Z"}],"ghsa":[{"id":"GHSA-r854-96gq-rfg3","title":"Pillow Temporary file name leakage","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2020-05-18T17:41:19Z","modified":"2025-04-13T23:22:52Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:39.85223Z"}],"nvd":[{"id":"CVE-2014-1933","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:55:11.12Z","modified":"2026-06-17T00:05:46.487Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-r854-96gq-rfg3","title":"Pillow Temporary file name leakage","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2020-05-18T17:41:19Z","modified":"2025-04-13T23:36:22.968033Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"CVE-2014-1933","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:55:11Z","modified":"2026-04-16T06:16:01.047232279Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1933","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:55:11.12Z","modified":"2026-10-23T15:47:35.406230696Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0158","title":"Updated python-imaging package fixes insecure use of temporary files","description":"Updated python-imaging packages fix security vulnerabilities:\n\nJakub Wilk discovered that temporary files were insecurely created (via\nmktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and\nEpsImagePlugin.py files of Python Imaging Library. A local attacker could use\nthis flaw to perform a symbolic link attack to modify an arbitrary file\naccessible to the user running an application that uses the Python Imaging\nLibrary (CVE-2014-1932).\n\nJakub Wilk discovered that temporary files created in the JpegImagePlugin.py\nand EpsImagePlugin.py files of the Python Imaging Library were passed to an\nexternal process. These could be viewed on the command line, allowing an\nattacker to obtain the name and possibly perform symbolic link attacks,\nallowing them to modify an arbitrary file accessible to the user running an\napplication that uses the Python Imaging Library (CVE-2014-1933).\n","status":"published","published":"2014-04-03T15:18:48Z","modified":"2026-04-16T06:25:55.222647549Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0159","title":"Updated python-pillow packages fix insecure use of temporary files","description":"Updated python-imaging packages fix security vulnerabilities:\n\nJakub Wilk discovered that temporary files were insecurely created (via\nmktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and\nEpsImagePlugin.py files of Python Imaging Library. A local attacker could use\nthis flaw to perform a symbolic link attack to modify an arbitrary file\naccessible to the user running an application that uses the Python Imaging\nLibrary (CVE-2014-1932).\n\nJakub Wilk discovered that temporary files created in the JpegImagePlugin.py\nand EpsImagePlugin.py files of the Python Imaging Library were passed to an\nexternal process. These could be viewed on the command line, allowing an\nattacker to obtain the name and possibly perform symbolic link attacks,\nallowing them to modify an arbitrary file accessible to the user running an\napplication that uses the Python Imaging Library (CVE-2014-1933).\n","status":"published","published":"2014-04-03T15:18:48Z","modified":"2026-04-16T06:24:24.075598408Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"PYSEC-2014-23","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","status":"published","published":"2014-04-17T14:55:00Z","modified":"2023-11-08T03:57:35.856922Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2015:0777-1","title":"Security update for python-Pillow","description":"\npython-pillow has been updated to 2.7.0 to fix three security issues.\n\nThe following vulnerabilities have been fixed:\n\n    * CVE-2014-9601: Remote attackers could have caused a denial of service\n      via a compressed text chunk in a PNG image that has a large size when\n      it is decompressed.\n    * CVE-2014-3598: Remote attackers could have caused a denial of service\n      using specially crafted image files via Jpeg2KImagePlugin.\n    * CVE-2014-3589: Remote attackers could have caused a denial of service\n      using specially crafted image files via IcnsImagePlugin.\n    * CVE-2014-1932: A local user could have overwritten arbitrary files\n      and obtain sensitive information via a symlink attack on the\n      temporary file.\n    * CVE-2014-1933: A local user could have gained information helpful for\n      symlink attacks by listing process information which uses the names\n      of temporary files on the command line.\n\nSecurity Issues:\n\n    * CVE-2014-9601\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9601\u003e\n    * CVE-2014-3598\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3598\u003e\n    * CVE-2014-3589\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3589\u003e\n    * CVE-2014-1932\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932\u003e\n    * CVE-2014-1933\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933\u003e\n\n","status":"published","published":"2015-04-22T14:27:27Z","modified":"2026-02-04T02:27:27.414878Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}