Steve Kemp discovered multiple temporary file handling issues in Emacs. A local attacker could use these flaws to perform symbolic link attacks against users running Emacs. Original report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100 CVE-2014-3421 was assigned to the issue in lisp/gnus/gnus-fun.el Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00055.html CVE-2014-3422 was assigned to the issue in lisp/emacs-lisp/find-gc.el Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00056.html CVE-2014-3423 was assigned to the issue in lisp/net/browse-url.el (this one does not currently have a fix) Upstream note: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html CVE-2014-3424 was assigned to the issue in lisp/net/tramp.el Upstream fix: http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00060.html References: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=747100 http://seclists.org/oss-sec/2014/q2/269 http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428
Created emacs tracking bugs for this issue: Affects: fedora-all [bug 1095587]
xemacs-21.5.31 did not have any of the affected files
CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 To execute symbolic link attacks attacker should have at least a user level access to the system where attack would be performed. This is a file overwrite issue, attacker can create symbolic link to a file that is readable by attacker for e.g ln -s /etc/shadow /tmp/esrc or ln -s /etc/passwd /tmp/Mosaic.$PID. If Emacs session is ran by a normal user without any extra privileges , attacker would be stopped to create such links where a normal user don't have any permissions, if the Emacs is ran with root then the attacker would have more privileges.
The bug can be close because of https://bugzilla.redhat.com/show_bug.cgi?id=1095587 is already closed, right? Or will there be a emacs updates for RHEL 5, 6 and 7? Greetings Petr
Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.