Executive Summary
| Informations | |||
|---|---|---|---|
| Name | MDVSA-2014:082 | First vendor Publication | 2014-05-08 |
| Vendor | Mandriva | Last vendor Modification | 2014-05-08 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 4.4 | Attack Range | Local |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 3.4 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Updated python-imaging packages fix security vulnerabilities: Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932). Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933). |
Original Source
| Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:082 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-264 | Permissions, Privileges, and Access Controls |
| 50 % | CWE-59 | Improper Link Resolution Before File Access ('Link Following') |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:24565 | |||
| Oval ID: | oval:org.mitre.oval:def:24565 | ||
| Title: | USN-2168-1 -- python-imaging vulnerabilities | ||
| Description: | Python Imaging Library could be made to overwrite or expose files. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-2168-1 CVE-2014-1932 CVE-2014-1933 | Version: | 5 |
| Platform(s): | Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | python-imaging |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25172 | |||
| Oval ID: | oval:org.mitre.oval:def:25172 | ||
| Title: | SUSE-SU-2014:0705-1 -- Security update for python-imaging | ||
| Description: | This python-imaging update fixes the following two security issues: * bnc#863541: Fixed insecure temporary file creation and handling (CVE-2014-1932, CVE-2014-1933) | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:0705-1 CVE-2014-1932 CVE-2014-1933 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 | Product(s): | python-imaging |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 2 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2017-01-03 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201612-52.nasl - Type : ACT_GATHER_INFO |
| 2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-099.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_py_pil_20140731.nasl - Type : ACT_GATHER_INFO |
| 2014-11-24 | Name : The remote Fedora host is missing a security update. File : fedora_2014-14883.nasl - Type : ACT_GATHER_INFO |
| 2014-11-24 | Name : The remote Fedora host is missing a security update. File : fedora_2014-14980.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-326.nasl - Type : ACT_GATHER_INFO |
| 2014-05-23 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_python-imaging-140422.nasl - Type : ACT_GATHER_INFO |
| 2014-05-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-082.nasl - Type : ACT_GATHER_INFO |
| 2014-05-02 | Name : The remote Fedora host is missing a security update. File : fedora_2014-5487.nasl - Type : ACT_GATHER_INFO |
| 2014-05-02 | Name : The remote Fedora host is missing a security update. File : fedora_2014-5492.nasl - Type : ACT_GATHER_INFO |
| 2014-04-16 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2168-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-05-10 13:25:55 |
|
| 2014-05-08 17:22:10 |
|
