CVE-2012-0035 Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project....
HighCVSS 9.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eric m ludlam cedet | <= 1.0 | No fix listed |
| eric m ludlam cedet | = 1.0-beta1 | No fix listed |
| eric m ludlam cedet | = 1.0-beta2 | No fix listed |
| eric m ludlam cedet | = 1.0-beta3 | No fix listed |
| eric m ludlam cedet | = 1.0-pre1 | No fix listed |
| eric m ludlam cedet | = 1.0-pre2 | No fix listed |
| eric m ludlam cedet | = 1.0-pre3 | No fix listed |
| eric m ludlam cedet | = 1.0-pre4 | No fix listed |
| eric m ludlam cedet | = 1.0-pre6 | No fix listed |
| eric m ludlam cedet | = 1.0-pre7 | No fix listed |
| GNU emacs | <= 23.3 | No fix listed |
| GNU emacs | = 20.0 | No fix listed |
| GNU emacs | = 20.1 | No fix listed |
| GNU emacs | = 20.2 | No fix listed |
| GNU emacs | = 20.3 | No fix listed |
| GNU emacs | = 20.4 | No fix listed |
| GNU emacs | = 20.5 | No fix listed |
| GNU emacs | = 20.6 | No fix listed |
| GNU emacs | = 20.7 | No fix listed |
| GNU emacs | = 21 | No fix listed |
| GNU emacs | = 21.1 | No fix listed |
| GNU emacs | = 21.2 | No fix listed |
| GNU emacs | = 21.2.1 | No fix listed |
| GNU emacs | = 21.3 | No fix listed |
| GNU emacs | = 21.3.1 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU emacs | = 21.4 | No fix listed |
| GNU emacs | = 22.1 | No fix listed |
| GNU emacs | = 22.2 | No fix listed |
| GNU emacs | = 22.3 | No fix listed |
| GNU emacs | = 23.1 | No fix listed |
| GNU emacs | = 23.2 | No fix listed |
| GNU emacs | = 23.4 | No fix listed |
References
- FEDORA-2012-0462 vendor-advisory
- FEDORA-2012-0494 vendor-advisory
- [emacs-devel] 20120109 Security flaw in EDE; new release plans mailing-list patch
- [oss-security] 20120109 CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability mailing-list patch
- [oss-security] 20120109 Re: Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability mailing-list
- 47311 third-party-advisory vendor-advisory
- 47515 third-party-advisory vendor-advisory
- 50801 third-party-advisory
- [cedet-devel] 20120109 Security flaw in EDE mailing-list
- [cedet-devel] 20120111 CEDET 1.0.1 available online mailing-list
- MDVSA-2013:076 vendor-advisory
- USN-1586-1 vendor-advisory
- GLSA-201812-05 vendor-advisory