CVE-2014-1933

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Apr 17, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-19343.3tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack oCVE-2014-19355.39base 1:6-6 and 1:6-7 insecurely creates temporary files which results in predictable filenames.CVE-2014-19367.5rc before 1.7.1-5 insecurely creates temporary files.CVE-2014-19377.5Gamera before 3.4.1 insecurely creates temporary files.CVE-2014-19385.5python-rply before 0.7.4 insecurely creates temporary files.CVE-2014-19397.5java/android/webkit/BrowserFrame.java in Android before 4.4 uses the addJavascriptInterface API in conjunction with creating an object of thCVE-2014-19424.3Cross-site scripting (XSS) vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote aCVE-2014-19435.0Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) CVE-2014-19444.3Cross-site scripting (XSS) vulnerability in Ilch CMS 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the CVE-2014-19457.5SQL injection vulnerability in ajax_udf.php in OpenDocMan before 1.2.7.2 allows remote attackers to execute arbitrary SQL commands via the aCVE-2014-19468.8OpenDocMan 1.2.7 and earlier does not properly validate allowed actions, which allows remote authenticated users to bypass an intended accesCVE-2014-19477.8Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause
CVE-2014-1933: Low severity, CVSS 2.1 | Vulnix