UnratedFix available
pillow — security advisory
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
- Products
- pillow
- Affected versions
- Not specified
- Fixed versions
- 2.4.0-1
- CVEs
- CVE-2014-1933
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:44 UTC · Revision 1
Source evidence
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.
osv:DEBIAN-CVE-2014-1933
pillow
Fixed versions: 2.4.0-1
pillow
Fixed versions: 2.4.0-1
pillow
Fixed versions: 2.4.0-1
Complete source record
{
"id": "105f34368bf85497d00edc539d7d648a48b38150bdcee0ab37e5c721ebf3eaf1",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-1933",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-1933",
"summary": "The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.",
"evidence": "osv:DEBIAN-CVE-2014-1933",
"products": [
{
"name": {
"value": "pillow",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.0-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pillow",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.0-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "pillow",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.4.0-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2014-1933",
"aliases": [
"DEBIAN-CVE-2014-1933"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0-1"
}
]
}
],
"package": {
"name": "pillow",
"purl": "pkg:deb/debian/pillow?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-1933.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0-1"
}
]
}
],
"package": {
"name": "pillow",
"purl": "pkg:deb/debian/pillow?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-1933.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0-1"
}
]
}
],
"package": {
"name": "pillow",
"purl": "pkg:deb/debian/pillow?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-1933.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T15:47:35.406230696Z",
"provider": "osv",
"upstream": [
"CVE-2014-1933"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-1933"
]
},
"related_cves": [
{
"value": "CVE-2014-1933",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 414311,
"published_at": "2014-04-17T14:55:11.12+00:00"
}