CVE-2014-3422

lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/...

CVE-2014-3423

lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic. temporary file...

CVE-2014-3424

lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp. temporary file...

PT-2014-5311

Name of the Vulnerable Software and Affected Versions GNU Emacs versions 24.3 and earlier Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file in /tmp/tramp.. Recommendations For GNU Emacs versions 24.3 and earlier, consider updating to a...

CVE-2014-3424: Improper Link Resolution Before File Access

lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp. temporary file...

KLA10169 WLF vulnerability in Emacs

An unspecified vulnerability was found in GNU Emacs. By exploiting this vulnerability malicious users can overwrite arbitrary tmp files. This vulnerability can be exploited locally via a symlink attack. Original advisories - Exploitation Related products GNU-Emacs CVE list CVE-2014-3424 warning...

CVE-2014-3422: Improper Link Resolution Before File Access

lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/...

PT-2014-5309

Name of the Vulnerable Software and Affected Versions GNU Emacs versions prior to 24.4 Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/. Recommendations For GNU Emacs versions prior to 24.4, update to version 24.4 or...

PT-2014-5310

Name of the Vulnerable Software and Affected Versions GNU Emacs versions 24.3 and earlier Description The issue allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic temporary file. Recommendations For GNU Emacs versions 24.3 and earlier, consider updating to a...

CVE-2014-3421: Improper Link Resolution Before File Access

lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file...

CVE-2014-3423: Improper Link Resolution Before File Access

lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic. temporary file...

PT-2014-5308

Name of the Vulnerable Software and Affected Versions GNU Emacs versions 24.3 and earlier Description The issue allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file. This is related to the lisp/gnus/gnus-fun.el component. Recommendations Fo...

GLSA-201403-05 : GNU Emacs: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201403-05 GNU Emacs: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GNU Emacs: When global-ede-mode is enabled, EDE in Emacs automatically loads a Project.ede file from the project directory CVE-2012-003...

GNU Emacs: Multiple vulnerabilities

Background GNU Emacs is a highly extensible and customizable text editor. Description Multiple vulnerabilities have been discovered in GNU Emacs: When ‘global-ede-mode’ is enabled, EDE in Emacs automatically loads a Project.ede file from the project directory CVE-2012-0035. When...

Mandriva Linux Security Advisory : emacs (MDVSA-2013:076)

Updated emacs packages fix security vulnerabilities : Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent...

Debian Security Advisory DSA 2603-1 (emacs23 - programming error)

Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to safe . OpenVAS Vulnerability Test $Id: deb2603.nasl 6611 2017-07-07 12:07:20Z cfischer $ Auto-generated from advisory DSA 2603-1 using nvtgen 1.0 Script version: 1.0 Author:...

FreeBSD : emacs -- remote code execution vulnerability (c1e5f35e-f93d-11e1-b07f-00235a5f2c9a)

Chong Yidong reports : Paul Ling has found a security flaw in the file-local variables code in GNU Emacs. When the Emacs user option enable-local-variables' is set to :safe' the default value is t, Emacs should automatically refuse to evaluate eval' forms in file-local variable sections. Due to t...

emacs -- remote code execution vulnerability

Chong Yidong reports: Paul Ling has found a security flaw in the file-local variables code in GNU Emacs. When the Emacs user option enable-local-variables' is set to :safe' the default value is t, Emacs should automatically refuse to evaluate eval' forms in file-local variable sections. Due to th...

CVE-2012-0035

CVE-2012-0035 is an untrusted search path vulnerability in EDE (CEDET) that allows a local user to escalate privileges by crafting a Project.ede file loaded from a project directory. The issue affects CEDET’s EDE in Emacs contexts (notably Emacs 23.x with CEDET before 1.0.1); analysis from Gentoo...

CVE-2012-0035

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file...