CVE-2014-1932

描述

The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.

如何修補 CVE-2014-1932

要修補 CVE-2014-1932,請將受影響套件升級到下列已修補版本。

• —升級至 2.4.0-1 或更新版本
• —升級至 2.3.1 或更新版本
• —升級至 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 或更新版本

CVE-2014-1932 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.4.0-1
• from 0, < 2.3.1
• from 0, < 4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7 | from 0, < 2.3.1

CVSS 分數

參考連結(13)

• ADVISORYgithub.com/advisories/GHSA-x895-2wrm-hvp7
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-1932
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-1932
• PATCHgithub.com/python-pillow/Pillow
• WEB