CVE-2003-1232: Medium severity gnu Emacs vulnerability

Published Dec 31, 2003

Updated

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.

Affected Software

1 affected component

gnu Emacs=21.2.1

Remediation

Patch Available

http://lists.grok.org.uk/pipermail/full-disclosure/2003-May/005089.html

Event History

Dec 31, 2003

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityAffected Software

Sep 26, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-1232?

CVE-2003-1232 is classified as a moderate severity vulnerability due to the risk of arbitrary code execution by user-assisted attackers.

How do I fix CVE-2003-1232?

To fix CVE-2003-1232, upgrade to a later version of Emacs where this vulnerability is addressed.

What type of attack does CVE-2003-1232 allow?

CVE-2003-1232 allows user-assisted attackers to execute arbitrary commands through uncontrolled execution of Lisp code.

Which versions of Emacs are affected by CVE-2003-1232?

CVE-2003-1232 specifically affects Emacs version 21.2.1.

Is user interaction required for CVE-2003-1232 to be exploited?

Yes, CVE-2003-1232 requires user interaction, as the attack involves executing code through local variables in a text file.