CVE-2008-1687 The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion,...
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU m4 | <= 1.4.10 | No fix listed |
| debian/m4(Debian:12) | All versions | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-3 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-4 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-4+hurd.1 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-5 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-6 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-7 | No fix listed |
| debian/m4(Debian:12) | = 1.4.19-8 | No fix listed |
| debian/m4(Debian:12) | = 1.4.20-1 | No fix listed |
| debian/m4(Debian:12) | = 1.4.20-2 | No fix listed |
| debian/m4(Debian:12) | = 1.4.21-1 | No fix listed |
| debian/m4(Debian:13) | All versions | No fix listed |
| debian/m4(Debian:13) | = 1.4.19-8 | No fix listed |
| debian/m4(Debian:13) | = 1.4.20-1 | No fix listed |
| debian/m4(Debian:13) | = 1.4.20-2 | No fix listed |
| debian/m4(Debian:13) | = 1.4.21-1 | No fix listed |
| debian/m4(Debian:14) | All versions | No fix listed |
| debian/m4(Debian:14) | = 1.4.19-8 | No fix listed |
| debian/m4(Debian:14) | = 1.4.20-1 | No fix listed |
| debian/m4(Debian:14) | = 1.4.20-2 | No fix listed |
| debian/m4(Debian:14) | = 1.4.21-1 | No fix listed |
References
- 29671 third-party-advisory vendor-advisory
- 29729 patch third-party-advisory vendor-advisory
- SSA:2008-098-01 vendor-advisory
- [oss-security] 20080406 Security fixes in m4-1.4.11 mailing-list
- [oss-security] 20080407 Re: Security fixes in m4-1.4.11 mailing-list
- [oss-security] 20080406 Re: Security fixes in m4-1.4.11 mailing-list
- [oss-security] 20080407 Re: Security fixes in m4-1.4.11 mailing-list
- 28688 vdb-entry
- ADV-2008-1151 vdb-entry
- gnu-m4-macros-weak-security(41706) vdb-entry
- Debian Security Tracker CVE-2008-1687 vendor-advisory