CVE-2014-1933 (published 2014-04-17T14:55Z)

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Severity: LOW
CVSS v2 base score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/python-imaging/Pillow
commit_details: repo_url: https://github.com/python-imaging/Pillow
author: wiredfool
author_date: 2014-03-14 15:56:41-07:00
msg: Removed tempfile.mktemp, fixes CVE-2014-1932 CVE-2014-1933, debian bug #737059
repository: repo_url: https://github.com/python-imaging/Pillow
repo_name: python-pillow/Pillow
description: Python Imaging Library (Fork)
repo_language: Python
owner: python-imaging
file_changes: filename: EpsImagePlugin.py
change_type: ModificationType.MODIFY
diff: @@ -67,7 +67,8 @@ def Ghostscript(tile, size, fp, scale=1):
 
     import tempfile, os, subprocess
 
-    file = tempfile.mktemp()
+    out_fd, file = tempfile.mkstemp()
+    os.close(out_fd)
 
     # Build ghostscript command
     command = ["gs",

programming_language: Python
filename: Image.py
change_type: ModificationType.MODIFY
diff: @@ -495,14 +495,17 @@ class Image:
         self.readonly = 0
 
     def _dump(self, file=None, format=None):
-        import tempfile
+        import tempfile, os
         if not file:
-            file = tempfile.mktemp()
+            f, file = tempfile.mkstemp(format or '')
+            os.close(f)
+            
         self.load()
         if not format or format == "PPM":
             self.im.save_ppm(file)
         else:
-            file = file + "." + format
+            if file.endswith(format):
+                file = file + "." + format
             self.save(file, format)
         return file
 

programming_language: Python
filename: IptcImagePlugin.py
change_type: ModificationType.MODIFY
diff: @@ -172,8 +172,8 @@ class IptcImageFile(ImageFile.ImageFile):
         self.fp.seek(offset)
 
         # Copy image data to temporary file
-        outfile = tempfile.mktemp()
-        o = open(outfile, "wb")
+        o_fd, outfile = tempfile.mkstemp(text=False)
+        o = os.fdopen(o_fd)
         if encoding == "raw":
             # To simplify access to the extracted file,
             # prepend a PPM header

programming_language: Python
filename: JpegImagePlugin.py
change_type: ModificationType.MODIFY
diff: @@ -344,13 +344,17 @@ class JpegImageFile(ImageFile.ImageFile):
         # ALTERNATIVE: handle JPEGs via the IJG command line utilities
 
         import tempfile, os
-        file = tempfile.mktemp()
-        os.system("djpeg %s >%s" % (self.filename, file))
+        f, path = tempfile.mkstemp()
+        os.close(f)
+        if os.path.exists(self.filename):
+            os.system("djpeg '%s' >'%s'" % (self.filename, path))
+        else:
+            raise ValueError("Invalid Filename")
 
         try:
-            self.im = Image.core.open_ppm(file)
+            self.im = Image.core.open_ppm(path)
         finally:
-            try: os.unlink(file)
+            try: os.unlink(path)
             except: pass
 
         self.mode = self.im.mode

programming_language: Python