Bug 1095586 (CVE-2014-3421, CVE-2014-3422, CVE-2014-3423, CVE-2014-3424)
Summary: | CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 emacs: multiple temporary file issues | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Murray McAllister <mmcallis> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED WONTFIX | QA Contact: | |
Severity: | low | Docs Contact: | |
Priority: | low | ||
Version: | unspecified | CC: | jchaloup, jkurik, jonathan.underwood, jrusnack, magoldma, mmcallis, phracek, sisharma |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Bug Fix | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2015-01-20 14:56:28 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1095587 | ||
Bug Blocks: | 1095588 |
Description
Murray McAllister
2014-05-08 05:22:29 UTC
Created emacs tracking bugs for this issue: Affects: fedora-all [bug 1095587] xemacs-21.5.31 did not have any of the affected files CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 To execute symbolic link attacks attacker should have at least a user level access to the system where attack would be performed. This is a file overwrite issue, attacker can create symbolic link to a file that is readable by attacker for e.g ln -s /etc/shadow /tmp/esrc or ln -s /etc/passwd /tmp/Mosaic.$PID. If Emacs session is ran by a normal user without any extra privileges , attacker would be stopped to create such links where a normal user don't have any permissions, if the Emacs is ran with root then the attacker would have more privileges. The bug can be close because of https://bugzilla.redhat.com/show_bug.cgi?id=1095587 is already closed, right? Or will there be a emacs updates for RHEL 5, 6 and 7? Greetings Petr Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. |