Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
BID:65511
Info
Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
| Bugtraq ID: | 65511 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-1932 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 10 2014 12:00AM |
| Updated: | Jan 12 2017 06:07AM |
| Credit: | Jakub Wilk |
| Vulnerable: |
Ubuntu Ubuntu Linux 13.10 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 python Python Imaging Library 2.2.1 Oracle Solaris 11.2 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux |
| Not Vulnerable: | |
Discussion
Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
Python Imaging Library is prone to multiple insecure temporary file-creation vulnerabilities.
An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
Python Imaging Library 2.2.1 is vulnerable; other versions may also be affected.
Python Imaging Library is prone to multiple insecure temporary file-creation vulnerabilities.
An attacker with local access could potentially exploit these issues to perform symbolic-link attacks, overwriting arbitrary files in the context of the affected application. Other attacks may also be possible.
Python Imaging Library 2.2.1 is vulnerable; other versions may also be affected.
Exploit / POC
Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
An attacker can use readily available commands to exploit this issue.
An attacker can use readily available commands to exploit this issue.
Solution / Fix
Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Mandriva Business Server 1 X86 64
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Mandriva Business Server 1 X86 64
-
Mandriva python-imaging-1.1.7-6.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva python-imaging-devel-1.1.7-6.1.mbs1.x86_64.rpm
http://www.mandriva.com/en/downloads/
References
Python Imaging Library Multiple Insecure Temporary File Creation Vulnerabilities
References:
References: