537 matches found
PT-2017-10957
Name of the Vulnerable Software and Affected Versions GNU Emacs version 25.3.1 Description The issue concerns GNU Emacs ignoring umask when creating a backup save file, resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary...
USN-3428-1: Emacs vulnerability
Charles A. Roelli discovered that Emacs incorrectly handled certain files. If a user were tricked into opening a specially crafted file e.g., email messages in gnus, an attacker could possibly use this to execute arbitrary code...
CentOS 7 : emacs (CESA-2017:2771)
An update for emacs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
RedHat Update for emacs RHSA-2017:2771-01
The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Important: Red Hat Security Advisory: emacs security update
An update for emacs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Design/Logic Flaw
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...
CVE-2017-14482
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...
CVE-2017-14482
GNU Emacs contains a command injection vulnerability in the enriched mode handling (CVE-2017-14482). The issue arises when rendering text/enriched MIME data in emails/news; a crafted message can cause arbitrary commands to execute with the privileges of the Emacs process. Exploitation requires th...
CVE-2017-14482
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...
CVE-2017-14482: Undefined Security Weakness
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...
CVE-2017-14482
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe...
PT-2017-13481
Name of the Vulnerable Software and Affected Versions GNU Emacs versions prior to 25.3 Description The issue allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands...
Gentoo Security Advisory GLSA 201403-05
Gentoo Linux Local Security Checks GLSA 201403-05 SPDX-FileCopyrightText: 2015 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...
GNU Emacs Local Information Disclosure Vulnerability
Emacs is an extensible real-time display editor. A local information disclosure vulnerability exists in GNU Emacs, which allows attackers to exploit the vulnerability to obtain sensitive information...
Info2www 1.0/1.1 CGI Input Handling Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1995/info The info2www script allows HTTP access to information stored in GNU EMACS Info Nodes. This script fails to properly parse input and can be used to execute commands on the server with permissions of the web serve...
[oss-security] CVE Request - Predictable temporary filenames in GNU Emacs
I reported these bugs on the Debian tracker on Monday: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100 In brief some of the bundled Emacs Lisp uses predictable /tmpfile names insecurely: lisp/gnus/gnus-fun.el: In the function gnus-grab-cam-face the file "/tmp/gnus.face.ppm" is used,...
GNU Emacs
Symbolic links vulnerability on temporary files creation...
CVE-2014-3424
lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp. temporary file...