-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2014:082 http://www.mandriva.com/en/support/security/ _______________________________________________________________________ Package : python-imaging Date : May 8, 2014 Affected: Business Server 1.0 _______________________________________________________________________ Problem Description: Updated python-imaging packages fix security vulnerabilities: Jakub Wilk discovered that temporary files were insecurely created (via mktemp()) in the IptcImagePlugin.py, Image.py, JpegImagePlugin.py, and EpsImagePlugin.py files of Python Imaging Library. A local attacker could use this flaw to perform a symbolic link attack to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1932). Jakub Wilk discovered that temporary files created in the JpegImagePlugin.py and EpsImagePlugin.py files of the Python Imaging Library were passed to an external process. These could be viewed on the command line, allowing an attacker to obtain the name and possibly perform symbolic link attacks, allowing them to modify an arbitrary file accessible to the user running an application that uses the Python Imaging Library (CVE-2014-1933). _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1932 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1933 http://advisories.mageia.org/MGASA-2014-0158.html _______________________________________________________________________ Updated Packages: Mandriva Business Server 1/X86_64: 1149eed41b2ff5bb93b835bbe1a8e1d4 mbs1/x86_64/python-imaging-1.1.7-6.1.mbs1.x86_64.rpm 926e3e1fd111002b5125aeee5295f8aa mbs1/x86_64/python-imaging-devel-1.1.7-6.1.mbs1.x86_64.rpm 0a038739fdb9a051c505e6b50247030e mbs1/SRPMS/python-imaging-1.1.7-6.1.mbs1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/en/support/security/advisories/ If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iD8DBQFTa3IVmqjQ0CJFipgRAjHnAKDYbhKap9i/MRGRk+DTsniLW3z5fACgqCrd dIQqMqLYqzurUBEy3JvlaQY= =7o1k -----END PGP SIGNATURE-----
