CVE-2014-3423

2014-05-0800:00:00

ubuntu.com

3.3 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to
overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.#####
temporary file.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100>

Notes

Author	Note
seth-arnold	Mosiac hard-coded this pid file name, the alternative is dropping support for Mosiac entirely. Don’t be hasty.
leosilva	from emacs, they added this line only http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html not-fixed