CVE-2008-1694 — Link Following in Emacs

CWE-59 — Link FollowingCWE-377 — Insecure Temporary File8 documents8 sources
Severity
4.6MEDIUMNVD
EPSS
0.0%
top 86.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
GNU Emacs
Timeline
PublishedApr 22
Latest updateMay 1

Description

vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages1 packages

▶NVDgnu/emacs5 versions+4

🔴Vulnerability Details

3
GHSA
GHSA-7cqh-9wjj-hhf9: vcdiff in Emacs 20↗2022-05-01
▶
OSV
CVE-2008-1694: vcdiff in Emacs 20↗2008-04-22
▶
CVEList
CVE-2008-1694: vcdiff in Emacs 20↗2008-04-21
▶

📋Vendor Advisories

3
Ubuntu
Emacs vulnerabilities↗2008-05-06
▶
Red Hat
emacs insecure /tmp file usage↗2008-04-11
▶
Debian
CVE-2008-1694: xemacs21 - vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to over...↗2008
▶

💬Community

1
Bugzilla
CVE-2008-1694 emacs insecure /tmp file usage↗2006-09-28
▶