Code Execution Vulnerability in GNU Emacs by The GNU Project
CVE-2012-3479

Currently unrated

Key Information:

Vendor
Gnu
Status
Emacs
Vendor
CVE Published:
25 August 2012

Summary

The vulnerability in GNU Emacs arises from the 'lisp/files.el' component, where under certain configurations, it can execute eval forms within file-local variable sections. Specifically, when the 'enable-local-variables' option is set to ':safe', it inadvertently enables the execution of potentially malicious Emacs Lisp code, allowing an attacker to leverage crafted files to execute arbitrary commands on a victim's system. This behavior poses a significant risk, particularly when users are tricked into opening files crafted by remote attackers.

References

http://www.slackware.com/security/viewer.php?l=slackware-...
vendor-advisoryx_refsource_SLACKWARE
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-updates/2012-10/msg000...
vendor-advisoryx_refsource_SUSE

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.