CVE-2014-1933
Published Apr 17, 2014
Last updated 7 years ago
Overview
- Description
- The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
- Source
- cve@mitre.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 2.1
- Impact score
- 2.9
- Exploitability score
- 3.9
- Vector string
- AV:L/AC:L/Au:N/C:N/I:P/A:N
Weaknesses
- nvd@nist.gov
- CWE-264
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1BAE1A0-BC57-4410-83DD-DB85B992398A",
"versionEndIncluding": "2.3.0"
},
{
"criteria": "cpe:2.3:a:pythonware:python_imaging_library:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C0BFFC56-855D-49E5-A4FD-7AA2D68F5B5C",
"versionEndIncluding": "1.1.7"
}
],
"operator": "OR"
}
]
}
]