CVE-2008-1688: High severity gnu m4 vulnerability

Published Apr 9, 2008

Updated

Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries.

Affected Software

10 affected components

GNU m4=1.4.1

GNU m4=1.4.2

GNU m4=1.4.3

GNU m4=1.4.4

GNU m4=1.4.5

GNU m4=1.4.6

GNU m4=1.4.7

GNU m4=1.4.8

GNU m4=1.4.9

GNU m4=1.4.10

Remediation

Patch Available

http://secunia.com/advisories/29729

Event History

Apr 9, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1688?

CVE-2008-1688 is considered to have an unspecified severity level, as it allows context-dependent attackers to execute arbitrary code.

How do I fix CVE-2008-1688?

To fix CVE-2008-1688, update GNU m4 to version 1.4.11 or later, where the vulnerability is addressed.

What versions of GNU m4 are affected by CVE-2008-1688?

CVE-2008-1688 affects GNU m4 versions 1.4.1 through 1.4.10 and earlier releases.

Who is affected by the CVE-2008-1688 vulnerability?

Users running vulnerable versions of GNU m4 may be affected by CVE-2008-1688, especially those utilizing the -F option.

Is CVE-2008-1688 a remote code execution vulnerability?

CVE-2008-1688 may lead to arbitrary code execution depending on how the filenames are handled, but it is not clearly defined as remote code execution.