lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1738 advisory.

    This advisory aggregates security fixes for the emacs SRPM in CIQ LTS 9.6. It addresses 14 CVEs:
    CVE-2012-3479, CVE-2012-0035, CVE-2024-53920, CVE-2024-30205, CVE-2026-96442, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0038 advisory.

    This advisory aggregates security fixes for the emacs SRPM in CIQ LTS 8.6. It addresses 8 CVEs:
    CVE-2012-0035, CVE-2025-1244, CVE-2012-3479, CVE-2014-3423, CVE-2014-3424, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0409 advisory.

    This advisory aggregates security fixes for the emacs SRPM in CIQ LTS 9.2. It addresses 11 CVEs:
    CVE-2012-0035, CVE-2025-1244, CVE-2024-30203, CVE-2012-3479, CVE-2014-3423, and 6 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the emacs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

  - lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files     via a symlink attack on a temporary file under /tmp/esrc/. (CVE-2014-3422)

  - lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on a /tmp/tramp.##### temporary file. (CVE-2014-3424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the emacs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

  - lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files     via a symlink attack on a temporary file under /tmp/esrc/. (CVE-2014-3422)

  - lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on a /tmp/tramp.##### temporary file. (CVE-2014-3424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Emacs has been updated to fix the following issues :

  - Several cases of insecure usage of temporary files.
    (CVE-2014-3421 / CVE-2014-3422 / CVE-2014-3423 /     CVE-2014-3424)

  - Use of vc-annotate for renamed files when using Git.
    (bnc#854683)

Updated emacs packages fix security vulnerabilities :

Steve Kemp discovered multiple temporary file handling issues in Emacs. A local attacker could use these flaws to perform symbolic link attacks against users running Emacs (CVE-2014-3421, CVE-2014-3422, CVE-2014-3423, CVE-2014-3424).

emacs was updated to fix four security issues.

These security issues were fixed :

  - Avoid unsecure usage of temporary files (CVE-2014-3421).

  - Avoid unsecure usage of temporary files (CVE-2014-3422).

  - Avoid unsecure usage of temporary files (CVE-2014-3423).

  - Avoid unsecure usage of temporary files (CVE-2014-3424).

CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 (#1095587)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
374511	Rocky Linux 9.6 [CIQ] Security Update: emacs / emacs-common / emacs-filesystem / emacs-lucid / emacs-nox Multiple Vulnerabilities (ciqsa-2026_1738)	Nessus	Rocky Linux Local Security Checks	Local	medium
357978	Rocky Linux 8.6 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0038)	Nessus	Rocky Linux Local Security Checks	Local	high
353878	Rocky Linux 9.2 [CIQ] Security Update: emacs / emacs-common / emacs-common-debuginfo / emacs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0409)	Nessus	Rocky Linux Local Security Checks	Local	high
165888	EulerOS Virtualization 3.0.6.6 : emacs (EulerOS-SA-2022-2494)	Nessus	Huawei Local Security Checks	Local	medium
161571	EulerOS 2.0 SP3 : emacs (EulerOS-SA-2022-1714)	Nessus	Huawei Local Security Checks	Local	medium
160121	EulerOS 2.0 SP5 : emacs (EulerOS-SA-2022-1528)	Nessus	Huawei Local Security Checks	Local	medium
83285	SuSE 11.3 Security Update : emacs (SAT Patch Number 10519)	Nessus	SuSE Local Security Checks	Local	low
82370	Mandriva Linux Security Advisory : emacs (MDVSA-2015:117)	Nessus	Mandriva Local Security Checks	Local	low
79368	openSUSE Security Update : emacs (openSUSE-SU-2014:1460-1)	Nessus	SuSE Local Security Checks	Local	low
74236	Fedora 20 : emacs-24.3-17.fc20 (2014-6554)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2014-3424

critical

Tenable Plugins

medium

high

high

medium

medium

medium

low

low

low

low