Updated emacs packages fix security vulnerabilities :

Steve Kemp discovered multiple temporary file handling issues in Emacs. A local attacker could use these flaws to perform symbolic link attacks against users running Emacs (CVE-2014-3421, CVE-2014-3422, CVE-2014-3423, CVE-2014-3424).

Emacs has been updated to fix the following issues :

  - Several cases of insecure usage of temporary files.
    (CVE-2014-3421 / CVE-2014-3422 / CVE-2014-3423 /     CVE-2014-3424)

  - Use of vc-annotate for renamed files when using Git.
    (bnc#854683)

According to the versions of the emacs packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

  - lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files     via a symlink attack on a temporary file under /tmp/esrc/. (CVE-2014-3422)

  - lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on a /tmp/tramp.##### temporary file. (CVE-2014-3424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - emacs: multiple temporary file issues (CVE-2014-3424)

  - emacs: command execution via shell metacharacters (CVE-2022-48337)

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

CVE-2014-3421 CVE-2014-3422 CVE-2014-3423 CVE-2014-3424 (#1095587)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

emacs was updated to fix four security issues.

These security issues were fixed :

  - Avoid unsecure usage of temporary files (CVE-2014-3421).

  - Avoid unsecure usage of temporary files (CVE-2014-3422).

  - Avoid unsecure usage of temporary files (CVE-2014-3423).

  - Avoid unsecure usage of temporary files (CVE-2014-3424).

According to the versions of the emacs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

  - lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files     via a symlink attack on a temporary file under /tmp/esrc/. (CVE-2014-3422)

  - lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on a /tmp/tramp.##### temporary file. (CVE-2014-3424)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - emacs: command injection flaw within enriched mode handling (CVE-2017-14482)

  - lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a     symlink attack on the /tmp/gnus.face.ppm temporary file. (CVE-2014-3421)

  - lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files     via a symlink attack on a temporary file under /tmp/esrc/. (CVE-2014-3422)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - emacs: command injection flaw within enriched mode handling (CVE-2017-14482)

  - vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via     a symlink attack on temporary files. (CVE-2008-1694)

  - Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files that are associated with other     files that are edited within Emacs, which allows user-assisted attackers to execute arbitrary code.
    (CVE-2008-2142)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
82370	Mandriva Linux Security Advisory : emacs (MDVSA-2015:117)	Nessus	Mandriva Local Security Checks	3/30/2015	1/14/2021	low
83285	SuSE 11.3 Security Update : emacs (SAT Patch Number 10519)	Nessus	SuSE Local Security Checks	5/8/2015	1/6/2021	low
161571	EulerOS 2.0 SP3 : emacs (EulerOS-SA-2022-1714)	Nessus	Huawei Local Security Checks	5/26/2022	5/26/2022	medium
160121	EulerOS 2.0 SP5 : emacs (EulerOS-SA-2022-1528)	Nessus	Huawei Local Security Checks	4/25/2022	12/14/2023	medium
198334	RHEL 7 : emacs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	critical
74236	Fedora 20 : emacs-24.3-17.fc20 (2014-6554)	Nessus	Fedora Local Security Checks	5/30/2014	1/11/2021	low
79368	openSUSE Security Update : emacs (openSUSE-SU-2014:1460-1)	Nessus	SuSE Local Security Checks	11/21/2014	1/19/2021	low
165888	EulerOS Virtualization 3.0.6.6 : emacs (EulerOS-SA-2022-2494)	Nessus	Huawei Local Security Checks	10/9/2022	10/9/2022	medium
198356	RHEL 6 : emacs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/4/2024	high
198414	RHEL 5 : emacs (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/4/2024	high

Detections

Analytics

Plugins Search

low

low

medium

medium

critical

low

low

medium

high

high