PYSEC-2014-22

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/pillow/PYSEC-2014-22.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2014-22

Aliases

Published

2014-04-17T14:55:00Z

Modified

2023-11-08T03:57:35.793172Z

Summary

[none]

Details

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

References

Affected packages

PyPI / pillow

Package

Name: pillow; View open source insights on deps.dev
Purl: pkg:pypi/pillow

Affected ranges

Type: GIT
Repo: https://github.com/python-imaging/Pillow
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.3.1

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7.0

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.7.7

1.7.8

2.*

2.0.0

2.1.0

2.2.0

2.2.1

2.2.2

2.3.0