CVE-2014-1933 Pillow Temporary file name leakage

What is CVE-2014-1933?

CVE-2014-1933 is a low-severity path traversal vulnerability in Python Pillow, published on 17 Apr 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Weakness: CWE-264

Which versions are affected by CVE-2014-1933?

3 open source packages ship an affected version, including pillow. It affects 2 products.

Products include Python Pillow, Pythonware Python Imaging Library.

How do I fix CVE-2014-1933?

Upgrade pillow to 2.3.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2014-1933 being exploited?

There is no known exploitation of CVE-2014-1933 in the wild and no public exploit code.

Other vulnerabilities in Python Pillow

• CVE-2014-3007 Pillow command injection Critical 10.0
• CVE-2026-96639 Pillow multi-frame loaders can reuse stale native image storage after mode transitions Critical 9.8
• CVE-2022-30595 Buffer over-flow in Pillow Critical 9.8
• CVE-2021-25289 Out of bounds write in Pillow Critical 9.8
• CVE-2016-4009 Pillow Integer overflow in ImagingResampleHorizontal Critical 9.8

All Python Pillow vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-1933, GHSA-r854-96gq-rfg3, PYSEC-2014-23.