{"api_version":"1","generated_at":"2026-07-23T09:13:11+00:00","cve":"CVE-2014-1933","urls":{"html":"https://cve.report/CVE-2014-1933","api":"https://cve.report/api/cve/CVE-2014-1933.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-1933","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-1933"},"summary":{"title":"CVE-2014-1933","description":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-04-17 14:55:11","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"2.1","severity":"","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:P/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/65513","name":"http://www.securityfocus.com/bid/65513","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Python Imaging Library Package Multiple Information Disclosure Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.ubuntu.com/usn/USN-2168-1","name":"http://www.ubuntu.com/usn/USN-2168-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-2168-1: Python Imaging Library vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2014/02/10/15","name":"http://www.openwall.com/lists/oss-security/2014/02/10/15","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc,\n Gamera, RPLY - insecure use of /tmp","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","name":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch"],"title":"Removed tempfile.mktemp, fixes CVE-2014-1932 CVE-2014-1933, debian bu… · python-pillow/Pillow@4e9f367 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1","name":"http://www.openwall.com/lists/oss-security/2014/02/11/1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","name":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"openSUSE-SU-2014:0591-1: python-imaging: Fix for temporary file race con","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201612-52","name":"https://security.gentoo.org/glsa/201612-52","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Pillow: Multiple vulnerabilities (GLSA 201612-52) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1933","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1933","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"1933","vulnerable":"1","versionEndIncluding":"2.3.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"python","cpe5":"pillow","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"1933","vulnerable":"1","versionEndIncluding":"1.1.7","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pythonware","cpe5":"python_imaging_library","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2014-1933","qid":"356406","title":"Amazon Linux Security Advisory for python-pillow : ALAS2-2023-2286"},{"cve":"CVE-2014-1933","qid":"981487","title":"Python (pip) Security Update for Pillow (GHSA-r854-96gq-rfg3)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:58:15.513Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"GLSA-201612-52","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"],"url":"https://security.gentoo.org/glsa/201612-52"},{"name":"[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2014/02/10/15"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"},{"name":"[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1"},{"name":"USN-2168-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-2168-1"},{"name":"openSUSE-SU-2014:0591","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html"},{"name":"65513","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/65513"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-02-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-06-30T16:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"GLSA-201612-52","tags":["vendor-advisory","x_refsource_GENTOO"],"url":"https://security.gentoo.org/glsa/201612-52"},{"name":"[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2014/02/10/15"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"},{"name":"[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2014/02/11/1"},{"name":"USN-2168-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-2168-1"},{"name":"openSUSE-SU-2014:0591","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html"},{"name":"65513","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/65513"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-1933","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"GLSA-201612-52","refsource":"GENTOO","url":"https://security.gentoo.org/glsa/201612-52"},{"name":"[oss-security] 20140210 CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2014/02/10/15"},{"name":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7","refsource":"CONFIRM","url":"https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7"},{"name":"[oss-security] 20140210 Re: CVE requests: Pacemaker, Python Imaging Library, eyeD3, 9base, rc, Gamera, RPLY - insecure use of /tmp","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2014/02/11/1"},{"name":"USN-2168-1","refsource":"UBUNTU","url":"http://www.ubuntu.com/usn/USN-2168-1"},{"name":"openSUSE-SU-2014:0591","refsource":"SUSE","url":"http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html"},{"name":"65513","refsource":"BID","url":"http://www.securityfocus.com/bid/65513"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-1933","datePublished":"2014-04-17T14:00:00.000Z","dateReserved":"2014-02-10T00:00:00.000Z","dateUpdated":"2024-08-06T09:58:15.513Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-04-17 14:55:11","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:N/I:P/A:N","baseScore":2.1,"accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":3.9,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:python:pillow:*:*:*:*:*:*:*:*","versionEndIncluding":"2.3.0","matchCriteriaId":"A1BAE1A0-BC57-4410-83DD-DB85B992398A"},{"vulnerable":true,"criteria":"cpe:2.3:a:pythonware:python_imaging_library:*:*:*:*:*:*:*:*","versionEndIncluding":"1.1.7","matchCriteriaId":"C0BFFC56-855D-49E5-A4FD-7AA2D68F5B5C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"1933","Ordinal":"1","Title":"CVE-2014-1933","CVE":"CVE-2014-1933","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"1933","Ordinal":"1","NoteData":"The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.","Type":"Description","Title":"CVE-2014-1933"},{"CveYear":"2014","CveId":"1933","Ordinal":"2","NoteData":"2014-04-17","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"1933","Ordinal":"3","NoteData":"2017-06-30","Type":"Other","Title":"Modified"}]}}}