Description
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pillow | 2.4.0-1 | — |
| Debian 13 | pillow | 2.4.0-1 | — |
| Debian 12 | pillow | 2.4.0-1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-pillow +4 | 2.0.0-23.gitd1c6db8.amzn2.0.8 | ALAS2-2023-2286 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | pillow | < 2.3.1 | 2.3.1 | GHSA-r854-96gq-rfg3 |
Advisories 1
- ALAS2-2023-2286 Important: python-pillow security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 5, 2023
References
- GLSA-201612-52 vendor-advisory
- [oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp mailing-list
- https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
- [oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp mailing-list
- USN-2168-1 vendor-advisory
- openSUSE-SU-2014:0591 vendor-advisory
- 65513 vdb-entry