CVE-2014-3422

2014-05-0800:00:00

ubuntu.com

CVSS2

3.3

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:P/A:P

EPSS

Percentile

5.1%

JSON

lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users
to overwrite arbitrary files via a symlink attack on a temporary file under
/tmp/esrc/.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100>

Notes

Author	Note
seth-arnold	The xemacs21-packages code looked very different; the esrc comment looks out-dated. I’m marking these not-affected because it looked safe to me but review by an emacs expert would be welcome.