CVE-2014-1933
python-imaging: temporary file name exposure in process list
Severity
LowRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · January 29, 2014
Updated · November 21, 2025
Description
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 2.1AV:L/AC:L/Au:N/C:N/I:P/A:N
CWE-214 · Invocation of Process Using Visible Sensitive Information