The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when
    a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to
    unspecified use of an incorrect filename. (CVE-2008-1687)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when     a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to     unspecified use of an incorrect filename. (CVE-2008-1687)

Note that Nessus relies on the presence of the package as reported by the vendor.

New m4 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues.

ID	Name	Product	Family	Type	Severity
459191	Echo: m4: security update to 1.4.11	Tenable Cloud Security	Echo Local Security Checks	Local	critical
459191	Echo: m4: security update to 1.4.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
232019	Linux Distros Unpatched Vulnerability : CVE-2008-1687	Nessus	Misc.	Local	critical
31802	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : m4 (SSA:2008-098-01)	Nessus	Slackware Local Security Checks	Local	high

Detections

Analytics

CVE-2008-1687

critical

Tenable Plugins

critical

critical

critical

high