CVE-2014-1933: Temporary file name leakage

April 17, 2014 (updated June 30, 2017)

In JpegImagePlugin.py, the load_jpeg(self) method generates a temporary file name and sends it to an external process. It is possible to alter the target file before it is read since the command line arguments are not kept secret.

References

seclists.org/oss-sec/2014/q1/310
bugs.debian.org/cgi-bin/bugreport.cgi?bug=737059

Detect and mitigate CVE-2014-1933 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →