Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0038 advisory.

    This advisory aggregates security fixes for the emacs SRPM in CIQ LTS 8.6. It addresses 8 CVEs:
    CVE-2012-0035, CVE-2025-1244, CVE-2012-3479, CVE-2014-3423, CVE-2014-3424, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0409 advisory.

    This advisory aggregates security fixes for the emacs SRPM in CIQ LTS 9.2. It addresses 11 CVEs:
    CVE-2012-0035, CVE-2025-1244, CVE-2024-30203, CVE-2012-3479, CVE-2014-3423, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201812-05 (EDE: Privilege escalation)

    An untrusted search path vulnerability was discovered in EDE.
  Impact :

    A local attacker could escalate his privileges via a specially crafted       Lisp expression in a Project.ede file in the directory or a parent       directory of an opened file.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201403-05 (GNU Emacs: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU Emacs:
      When &lsquo;global-ede-mode&rsquo; is enabled, EDE in Emacs automatically         loads a Project.ede file from the project directory (CVE-2012-0035).
      When &lsquo;enable-local-variables&rsquo;&rsquo; is set to &lsquo;:safe&rsquo;, Emacs         automatically processes eval forms (CVE-2012-3479).
  Impact :

    A remote attacker could entice a user to open a specially crafted file,       possibly resulting in execution of arbitrary code with the privileges of       the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201401-31 (CEDET: Privilege escalation)

    An untrusted search path vulnerability was discovered in CEDET.
  Impact :

    A local attacker could escalate his privileges via a specially crafted       Lisp expression in a Project.ede file in the directory or a parent       directory of an opened file.
  Workaround :

    There is no known workaround at this time.

Updated emacs packages fix security vulnerabilities :

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file (CVE-2012-0035).

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file (CVE-2012-3479).

Additionally a problem was fixed reading xz compressed files (mga#7759).

Hiroshi Oota discovered that Emacs incorrectly handled search paths.
If a user were tricked into opening a file with Emacs, a local attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-0035)

Paul Ling discovered that Emacs incorrectly handled certain eval forms in local-variable sections. If a user were tricked into opening a specially crafted file with Emacs, a remote attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-3479).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2012-0035 emacs: CEDET global-ede-mode file loading vulnerability

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
357978	Rocky Linux 8.6 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0038)	Nessus	Rocky Linux Local Security Checks	Local	high
353878	Rocky Linux 9.2 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0409)	Nessus	Rocky Linux Local Security Checks	Local	high
119483	GLSA-201812-05 : EDE: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	high
73127	GLSA-201403-05 : GNU Emacs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
72158	GLSA-201401-31 : CEDET: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	high
66090	Mandriva Linux Security Advisory : emacs (MDVSA-2013:076)	Nessus	Mandriva Local Security Checks	Local	high
62365	Ubuntu 11.10 / 12.04 LTS : emacs23 vulnerabilities (USN-1586-1)	Nessus	Ubuntu Local Security Checks	Local	high
57645	Fedora 16 : emacs-23.3-9.fc16 (2012-0494)	Nessus	Fedora Local Security Checks	Local	high
57644	Fedora 15 : emacs-23.3-8.fc15 (2012-0462)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2012-0035

high

Tenable Plugins

high

high

high

high

high

high

high

high

high