---
title: "CVE-2014-1932\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2014-1932?format=md
keywords: index, follow
---

# CVE-2014-1932

Publication date 21 February 2014

Last updated 21 September 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The (1) load\_djpeg function in JpegImagePlugin.py, (2) Ghostscript function
in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4)
\_copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier
and Pillow before 2.3.1 do not properly create temporary files, which allow
local users to overwrite arbitrary files and obtain sensitive information
via a symlink attack on the temporary file.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2014-1932?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| pillow | 13.10 saucy | Not in release |
| 12.10 quantal | Not in release |
| 12.04 LTS precise | Not in release |
| 10.04 LTS lucid | Not in release |
| python-imaging | 13.10 saucy | Fixed 1.1.7+2.0.0-1ubuntu1.1 |
| 12.10 quantal | Fixed 1.1.7-4ubuntu0.12.10.1 |
| 12.04 LTS precise | Fixed 1.1.7-4ubuntu0.12.04.1 |
| 10.04 LTS lucid | Fixed 1.1.7-1ubuntu0.2 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2014-1932?format=md#patch-details)

## Notes

---

### [seth-arnold](https://launchpad.net/~seth-arnold)

Normally mktemp() mistakes are classed as 'low' because Ubuntu has
hardlink and symlink protections in the kernel. However, one of the discovered
flaws is almost certainly also a shell metacharacter injection problem.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| python-imaging | * Upstream:   [a549e77](https://github.com/wiredfool/Pillow/commit/a549e77bd8219a75ac745dcecc09cb963b4032a6) * Upstream:   [1e331e3](https://github.com/wiredfool/Pillow/commit/1e331e3e6a40141ca8eee4f5da9f74e895423b66) |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-1932)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2014-1932)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2014-1932)

### Related Ubuntu Security Notices (USN)

+ [USN-2168-1](https://usn.ubuntu.com/USN-2168-1)
+ Python Imaging Library vulnerabilities
+ 15 April 2014

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2014-1932>