Advisory ROSA-SA-2021-1828

Software: emacs 24.3
OS: Cobalt 7.9

CVE-ID: CVE-2014-3421
CVE-Crit: CRITICAL
CVE-DESC: lisp / gnus / gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files using a symbolic link attack on the temporary file /tmp/gnus.face.ppm.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2014-3422
CVE-Crit: CRITICAL
CVE-DESC: lisp / emacs-lisp / find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files using a symbolic link attack on a temporary file in / tmp / esrc /.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2014-3423
CVE-Crit: CRITICAL
CVE-DESC: lisp / net / browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files using a symbolic link attack on the temporary file /tmp/Mosaic.#####.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2014-3424
CVE-Crit: CRITICAL
CVE-DESC: lisp / net / tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files using a symbolic link attack on the temporary file /tmp/tramp.#####.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2017-1000383
CVE-Crit: MEDIUM
CVE-DESC: GNU Emacs version 25.3.1 (and likely other versions) ignores umask when creating a backup save file (“[ORIGINAL_FILENAME] ~”), resulting in files that can be read-only to all or otherwise accessed in ways not intended by the user running the emacs binary.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2017-14482
CVE-Crit: HIGH
CVE-DESC: GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with generated Content-Type: text / enriched data containing an x-display XML element that defines the execution of shell commands associated with the insecure text / enriched extension in lisp / textmodes / enriched.el and insecure Gnus support for the embedded MIME objects enriched and richtext in lisp / gnus / mm-view.el. In particular, an Emacs user could be instantly compromised by reading an e-mail message (or Usenet news article) that was created.
CVE-STATUS: default
CVE-REV: default