Description
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.4.0-1 | — |
| Debian 13 | pillow | 2.4.0-1 | — |
| Debian 12 | pillow | 2.4.0-1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-pillow +4 | 2.0.0-23.gitd1c6db8.amzn2.0.8 | ALAS2-2023-2286 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.3.1 | 2.3.1 | GHSA-x895-2wrm-hvp7 |
Advisories 1
- ALAS2-2023-2286 Important: python-pillow security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 5, 2023
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059
- GLSA-201612-52 vendor-advisory
- https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp mailing-list
- USN-2168-1 vendor-advisory
- 65511 vdb-entry
- openSUSE-SU-2014:0591 vendor-advisory