CVE-2008-1694 vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
MediumCVSS 4.6
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU emacs | = 20.7 | No fix listed |
| GNU emacs | = 21.1 | No fix listed |
| GNU emacs | = 21.2 | No fix listed |
| GNU emacs | = 21.3 | No fix listed |
| GNU emacs | = 21.4 | No fix listed |
| GNU sccs | All versions | No fix listed |
| debian/xemacs21(Debian:12) | < 21.4.21-4 | 21.4.21-4 |
References
- bugs.gentoo.org
- 29905 third-party-advisory
- 29926 third-party-advisory
- 30109 third-party-advisory
- MDVSA-2008:096 vendor-advisory
- 28857 vdb-entry
- 1019909 vdb-entry
- ADV-2008-1309 vdb-entry
- ADV-2008-1310 vdb-entry
- bugzilla.redhat.com
- xemacs-gnuemacs-vcdiff-symlink(41906) vdb-entry
- USN-607-1 vendor-advisory
- Debian Security Tracker CVE-2008-1694 vendor-advisory
- bugs.debian.org issue-tracking