hitoshura25/cvefixes huggingface dataset:
CVE-2016-3119 (C, published 2016-03-26T01:59Z)
Description: value: The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/krb5/krb5
Files changed:
src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
Commit message: Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array.  Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

    CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

ticket: 8383 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup


Vulnerable code:

Fixed code:
            arg = (arg != NULL) ? arg : "";
CVE-2016-3120 (Python, published 2016-08-01T02:59Z)
Description: value: The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/krb5/krb5
Files changed:
src/kdc/kdc_util.c
src/tests/t_pkinit.py
Commit message: Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

  CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

ticket: 8458 (new)
target_version: 1.14-next
target_version: 1.13-next


Vulnerable code:
    if (check_anon(kdc_active_realm, request->client, request->server) != 0) {

Fixed code:
    if (check_anon(kdc_active_realm, client.princ, request->server) != 0) {
# Regression test for #8458: S4U2Self requests crash the KDC if
# anonymous is restricted.
realm.kinit(realm.host_princ, flags=['-k'])
realm.run([kvno, '-U', 'user', realm.host_princ])
CVE-2017-11368 (C, published 2017-08-09T18:29Z)
Description: value: In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/krb5/krb5
Files changed:
src/kdc/do_as_req.c
src/kdc/do_tgs_req.c
src/kdc/kdc_util.c
Commit message: Prevent KDC unset status assertion failures

Assign status values if S4U2Self padata fails to decode, if an
S4U2Proxy request uses invalid KDC options, or if an S4U2Proxy request
uses an evidence ticket which does not match the canonicalized request
server principal name.  Reported by Samuel Cabrero.

If a status value is not assigned during KDC processing, default to
"UNKNOWN_REASON" rather than failing an assertion.  This change will
prevent future denial of service bugs due to similar mistakes, and
will allow us to omit assigning status values for unlikely errors such
as small memory allocation failures.

CVE-2017-11368:

In MIT krb5 1.7 and later, an authenticated attacker can cause an
assertion failure in krb5kdc by sending an invalid S4U2Self or
S4U2Proxy request.

  CVSSv3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C

ticket: 8599 (new)
target_version: 1.15-next
target_version: 1.14-next
tags: pullup


Vulnerable code:
    if (errcode != 0)
        assert (state->status != 0);
    assert(status != NULL);
    if (code)
    if (code)

Fixed code:
    if (errcode != 0 && state->status == NULL)
        state->status = "UNKNOWN_REASON";
    if (status == NULL)
        status = "UNKNOWN_REASON";
    if (code) {
        *status = "DECODE_PA_FOR_USER";
    }
    if (code) {
        *status = "DECODE_PA_S4U_X509_USER";
    }
        *status = "INVALID_S4U2PROXY_OPTIONS";
        *status = "EVIDENCE_TICKET_MISMATCH";
CVE-2018-20217 (C, published 2018-12-26T21:29Z)
Description: value: A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/krb5/krb5
Files changed:
src/kdc/kdc_util.c
src/lib/krb5/krb/s4u_creds.c
src/tests/gssapi/t_s4u.py
Commit message: Ignore password attributes for S4U2Self requests

For consistency with Windows KDCs, allow protocol transition to work
even if the password has expired or needs changing.

Also, when looking up an enterprise principal with an AS request,
treat ERR_KEY_EXP as confirmation that the client is present in the
realm.

[ghudson@mit.edu: added comment in kdc_process_s4u2self_req(); edited
commit message]

ticket: 8763 (new)
tags: pullup
target_version: 1.17


Vulnerable code:
    if (code == 0 || code == KRB5_PREAUTH_FAILED) {

Fixed code:
        /* Ignore password expiration and needchange attributes (as Windows
         * does), since S4U2Self is not password authentication. */
        princ->pw_expiration = 0;
        clear(princ->attributes, KRB5_KDB_REQUIRES_PWCHANGE);

    if (!code || code == KRB5_PREAUTH_FAILED || code == KRB5KDC_ERR_KEY_EXP) {
# Try S4U2Self for user with a restricted password.
realm.run([kadminl, 'modprinc', '+needchange', realm.user_princ])
realm.run(['./t_s4u', 'e:user', '-'])
realm.run([kadminl, 'modprinc', '-needchange',
          '-pwexpire', '1/1/2000', realm.user_princ])
realm.run(['./t_s4u', 'e:user', '-'])
realm.run([kadminl, 'modprinc', '-pwexpire', 'never', realm.user_princ])
CVE-2020-28196 (C, published 2020-11-06T08:15Z)
Description: value: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/krb5/krb5
Files changed:
src/lib/krb5/asn.1/asn1_encode.c
Commit message: Add recursion limit for ASN.1 indefinite lengths

The libkrb5 ASN.1 decoder supports BER indefinite lengths.  It
computes the tag length using recursion; the lack of a recursion limit
allows an attacker to overrun the stack and cause the process to
crash.  Reported by Demi Obenour.

CVE-2020-28196:

In MIT krb5 releases 1.11 and later, an unauthenticated attacker can
cause a denial of service for any client or server to which it can
send an ASN.1-encoded Kerberos message of sufficient length.

ticket: 8959 (new)
tags: pullup
target_version: 1.18-next
target_version: 1.17-next


Vulnerable code:
        const uint8_t **remainder_out, size_t *rlen_out)
            ret = get_tag(p, len, &t, &c, &clen, &p, &len);
    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen);
            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen);
        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
                  &clen, &remainder, &rlen);

Fixed code:
        const uint8_t **remainder_out, size_t *rlen_out, int recursion)
        if (recursion >= 32)
            return ASN1_OVERFLOW;
            ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1);
    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0);
            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0);
        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
                  &clen, &remainder, &rlen, 0);
CVE-2021-37750 (C, published 2021-08-23T05:15Z)
Description: value: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/krb5/krb5
Files changed:
src/kdc/do_tgs_req.c
Commit message: Fix KDC null deref on TGS inner body null server

After the KDC decodes a FAST inner body, it does not check for a null
server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
would typically result in an error from krb5_unparse_name(), but with
the addition of get_local_tgt() it results in a null dereference.  Add
a null check.

Reported by Joseph Sutton of Catalyst.

CVE-2021-37750:

In MIT krb5 releases 1.14 and later, an authenticated attacker can
cause a null dereference in the KDC by sending a FAST TGS request with
no server field.

ticket: 9008 (new)
tags: pullup
target_version: 1.19-next
target_version: 1.18-next


Vulnerable code:

Fixed code:
    if (sprinc == NULL) {
        status = "NULL_SERVER";
        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
        goto cleanup;
    }
CVE-2022-42898 (C, published 2022-12-25T06:15Z)
Description: value: PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/krb5/krb5
Files changed:
src/lib/krb5/krb/pac.c
src/lib/krb5/krb/t_pac.c
Commit message: Fix integer overflows in PAC parsing

In krb5_parse_pac(), check for buffer counts large enough to threaten
integer overflow in the header length and memory length calculations.
Avoid potential integer overflows when checking the length of each
buffer.  Credit to OSS-Fuzz for discovering one of the issues.

CVE-2022-42898:

In MIT krb5 releases 1.8 and later, an authenticated attacker may be
able to cause a KDC or kadmind process to crash by reading beyond the
bounds of allocated memory, creating a denial of service.  A
privileged attacker may similarly be able to cause a Kerberos or GSS
application service to crash.  On 32-bit platforms, an attacker can
also cause insufficient memory to be allocated for the result,
potentially leading to remote code execution in a KDC, kadmind, or GSS
or Kerberos application server process.  An attacker with the
privileges of a cross-realm KDC may be able to extract secrets from a
KDC process's memory by having them copied into the PAC of a new
ticket.

ticket: 9074 (new)
tags: pullup
target_version: 1.20-next
target_version: 1.19-next


Vulnerable code:
        if (buffer->Offset < header_len ||
            buffer->Offset + buffer->cbBufferSize > len) {

Fixed code:
#define MAX_BUFFERS 4096

    if (cbuffers < 1 || cbuffers > MAX_BUFFERS)
        return ERANGE;

        if (buffer->Offset < header_len || buffer->Offset > len ||
            buffer->cbBufferSize > len - buffer->Offset) {
static const unsigned char fuzz1[] = {
    0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
    0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5
};

static const unsigned char fuzz2[] = {
    0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00,
    0x20, 0x20
};

    /* Check problematic PACs found by fuzzing. */
    ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac);
    if (!ret)
        err(context, ret, "krb5_pac_parse should have failed");
    ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac);
    if (!ret)
        err(context, ret, "krb5_pac_parse should have failed");
CVE-2023-36054 (C, published 2023-08-07T19:15Z)
Description: value: lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/krb5/krb5
Files changed:
src/lib/kadm5/kadm_rpc_xdr.c
Commit message: Ensure array count consistency in kadm5 RPC

In _xdr_kadm5_principal_ent_rec(), ensure that n_key_data matches the
key_data array count when decoding.  Otherwise when the structure is
later freed, xdr_array() could iterate over the wrong number of
elements, either leaking some memory or freeing uninitialized
pointers.  Reported by Robert Morris.

CVE-2023-36054:

An authenticated attacker can cause a kadmind process to crash by
freeing uninitialized pointers.  Remote code execution is unlikely.
An attacker with control of a kadmin server can cause a kadmin client
to crash by freeing uninitialized pointers.

ticket: 9099 (new)
tags: pullup
target_version: 1.21-next
target_version: 1.20-next


Vulnerable code:
	if (!xdr_array(xdrs, (caddr_t *) &objp->key_data,
		       &n, ~0, sizeof(krb5_key_data),
		       xdr_krb5_key_data_nocontents)) {

Fixed code:
	bool_t r;
	if (xdrs->x_op == XDR_DECODE && objp->n_key_data < 0) {
		return (FALSE);
	}
	r = xdr_array(xdrs, (caddr_t *) &objp->key_data, &n, objp->n_key_data,
		      sizeof(krb5_key_data), xdr_krb5_key_data_nocontents);
	objp->n_key_data = n;
	if (!r) {
CVE-2023-39975 (C, published 2023-08-16T15:15Z)
Description: value: kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/krb5/krb5
Files changed:
src/kdc/do_tgs_req.c
Commit message: Fix double-free in KDC TGS processing

When issuing a ticket for a TGS renew or validate request, copy only
the server field from the outer part of the header ticket to the new
ticket.  Copying the whole structure causes the enc_part pointer to be
aliased to the header ticket until krb5_encrypt_tkt_part() is called,
resulting in a double-free if handle_authdata() fails.

[ghudson@mit.edu: changed the fix to avoid aliasing enc_part rather
than check for aliasing before freeing; rewrote commit message]

CVE-2023-39975:

In MIT krb5 release 1.21, an authenticated attacker can cause a KDC to
free the same pointer twice if it can induce a failure in
authorization data handling.

ticket: 9101 (new)
tags: pullup
target_version: 1.21-next


Vulnerable code:
        /* Copy the whole header ticket except for authorization data. */
        ticket_reply = *t->header_tkt;

Fixed code:
        /* Copy the header ticket server and all enc-part fields except for
         * authorization data. */
        ticket_reply.server = t->header_tkt->server;
CVE-2018-20835 (JavaScript, published 2019-04-30T19:29Z)
Description: value: A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/mafintosh/tar-fs
Files changed:
index.js
Commit message: force hardlink targets to be in the tar


Vulnerable code:
        var srcpath = path.resolve(cwd, header.linkname)

Fixed code:
        var srcpath = path.join(cwd, path.join('/', header.linkname))
CVE-2023-5555 (Unknown, published 2023-10-12T11:15Z)
Description: value: Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/frappe/lms
Files changed:
Commit message: Merge pull request #622 from pateljannat/issues

fix: sanitized inputs for people and course creation page

Vulnerable code:

Fixed code:
CVE-2021-3694 (Unknown, published 2021-08-23T13:15Z)
Description: value: LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.
Severity: MEDIUM (CVSS v3 base score: 9.6)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/ledgersmb/ledgersmb
Files changed:
Commit message: Merge pull request #5744 from ledgersmb/html-escape-error-messages

Html escape error messages

Vulnerable code:

Fixed code:
CVE-2017-18120 (C, published 2018-02-02T09:29Z)
Description: value: A double-free bug in the read_gif function in gifread.c in gifsicle 1.90 allows a remote attacker to cause a denial-of-service attack or unspecified other impact via a maliciously crafted file, because last_name is mishandled, a different vulnerability than CVE-2017-1000421.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/kohler/gifsicle
Files changed:
src/gifread.c
Commit message: gif_read: Set last_name = NULL unconditionally.

With a non-malicious GIF, last_name is set to NULL when a name
extension is followed by an image. Reported in #117, via
Debian, via a KAIST fuzzing program.


Vulnerable code:

Fixed code:
  last_name = 0;
CVE-2020-35460 (Java, published 2020-12-14T23:15Z)
Description: value: common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/joniles/mpxj
Files changed:
src/main/java/net/sf/mpxj/common/InputStreamHelper.java
Commit message: zip slip fix

Vulnerable code:

Fixed code:
      String canonicalDestinationDirPath = dir.getCanonicalPath();

         // https://snyk.io/research/zip-slip-vulnerability
         String canonicalDestinationFile = file.getCanonicalPath();
         if (!canonicalDestinationFile.startsWith(canonicalDestinationDirPath + File.separator))
         {
            throw new IOException("Entry is outside of the target dir: " + entry.getName());
         }
CVE-2014-1932 (Python, published 2014-04-17T14:55Z)
Description: value: The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/python-imaging/Pillow
Files changed:
PIL/EpsImagePlugin.py
PIL/Image.py
PIL/IptcImagePlugin.py
PIL/JpegImagePlugin.py
Commit message: Removed tempfile.mktemp, fixes CVE-2014-1932 CVE-2014-1933, debian bug #737059


Vulnerable code:
    file = tempfile.mktemp()
        import tempfile
            file = tempfile.mktemp()
            file = file + "." + format
        outfile = tempfile.mktemp()
        o = open(outfile, "wb")
        file = tempfile.mktemp()
        os.system("djpeg %s >%s" % (self.filename, file))
            self.im = Image.core.open_ppm(file)
            try: os.unlink(file)

Fixed code:
    out_fd, file = tempfile.mkstemp()
    os.close(out_fd)
        import tempfile, os
            f, file = tempfile.mkstemp(format or '')
            os.close(f)
            
            if file.endswith(format):
                file = file + "." + format
        o_fd, outfile = tempfile.mkstemp(text=False)
        o = os.fdopen(o_fd)
        f, path = tempfile.mkstemp()
        os.close(f)
        if os.path.exists(self.filename):
            os.system("djpeg '%s' >'%s'" % (self.filename, path))
        else:
            raise ValueError("Invalid Filename")
            self.im = Image.core.open_ppm(path)
            try: os.unlink(path)