Python Imaging Library Package Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	65513
Class:	Input Validation Error
CVE:	CVE-2014-1933
Remote:	No
Local:	Yes
Published:	Feb 10 2014 12:00AM
Updated:	Jan 12 2017 06:07AM
Credit:	Jakub Wilk
Vulnerable:	Ubuntu Ubuntu Linux 13.10 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 python Python Imaging Library 2.2.1 Oracle Solaris 11.2 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Gentoo Linux
Not Vulnerable:

Python Imaging Library Package Multiple Information Disclosure Vulnerabilities

Python Imaging Library package is prone to multiple information disclosure vulnerabilities.

An attacker with local access could potentially exploit these issues to gain sensitive information. Other attacks may also be possible.

Python Imaging Library 2.2.1 is vulnerable; other versions may also be affected.

Python Imaging Library Package Multiple Information Disclosure Vulnerabilities

An attacker can use readily available commands to exploit this issue.

Python Imaging Library Package Multiple Information Disclosure Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].


Mandriva Business Server 1 X86 64

• Mandriva python-imaging-1.1.7-6.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva python-imaging-devel-1.1.7-6.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Python Imaging Library Package Multiple Information Disclosure Vulnerabilities

References:

• python-pil: CVE-2014-1932 CVE-2014-1933 (Debian)
  
• Multiple vulnerabilities in Python Image Library (PIL) (Oracle)
  
• Python Imaging Library (PIL) Homepage (Python)