CVE-2012-0035
First published: Thu Jan 19 2012(Updated: )
Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cedet | <=1.0 | |
| Cedet | =1.0-beta1 | |
| Cedet | =1.0-beta2 | |
| Cedet | =1.0-beta3 | |
| Cedet | =1.0-pre1 | |
| Cedet | =1.0-pre2 | |
| Cedet | =1.0-pre3 | |
| Cedet | =1.0-pre4 | |
| Cedet | =1.0-pre6 | |
| Cedet | =1.0-pre7 | |
| GNU Emacs | <=23.3 | |
| GNU Emacs | =20.0 | |
| GNU Emacs | =20.1 | |
| GNU Emacs | =20.2 | |
| GNU Emacs | =20.3 | |
| GNU Emacs | =20.4 | |
| GNU Emacs | =20.5 | |
| GNU Emacs | =20.6 | |
| GNU Emacs | =20.7 | |
| GNU Emacs | =21 | |
| GNU Emacs | =21.1 | |
| GNU Emacs | =21.2 | |
| GNU Emacs | =21.2.1 | |
| GNU Emacs | =21.3 | |
| GNU Emacs | =21.3.1 | |
| GNU Emacs | =21.4 | |
| GNU Emacs | =22.1 | |
| GNU Emacs | =22.2 | |
| GNU Emacs | =22.3 | |
| GNU Emacs | =23.1 | |
| GNU Emacs | =23.2 | |
| GNU Emacs | =23.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html
- http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.html
- http://openwall.com/lists/oss-security/2012/01/10/2
- http://openwall.com/lists/oss-security/2012/01/10/4
- http://secunia.com/advisories/47311
- http://secunia.com/advisories/47515
- http://secunia.com/advisories/50801
- http://sourceforge.net/mailarchive/message.php?msg_id=28649762
- http://sourceforge.net/mailarchive/message.php?msg_id=28657612
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:076
- http://www.ubuntu.com/usn/USN-1586-1
- https://security.gentoo.org/glsa/201812-05
Frequently Asked Questions
What is the severity of CVE-2012-0035?
CVE-2012-0035 is considered a high severity vulnerability due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2012-0035?
To fix CVE-2012-0035, update to a patched version of GNU Emacs or CEDET that addresses this vulnerability.
Who is affected by CVE-2012-0035?
CVE-2012-0035 affects local users of GNU Emacs versions prior to 23.4 and all versions of CEDET prior to 1.0.1.
What is the nature of the vulnerability in CVE-2012-0035?
The vulnerability in CVE-2012-0035 is an untrusted search path issue that can be exploited through a crafted Lisp expression.
Can CVE-2012-0035 be exploited remotely?
No, CVE-2012-0035 can only be exploited locally by users who have access to the affected system.
- agent/severity
- agent/event
- agent/description
- agent/author
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/eric m ludlam
- canonical/cedet
- version/cedet/1.0
- version/cedet/1.0-beta1
- version/cedet/1.0-beta2
- version/cedet/1.0-beta3
- version/cedet/1.0-pre1
- version/cedet/1.0-pre2
- version/cedet/1.0-pre3
- version/cedet/1.0-pre4
- version/cedet/1.0-pre6
- version/cedet/1.0-pre7
- vendor/gnu
- canonical/gnu emacs
- version/gnu emacs/23.3
- version/gnu emacs/20.0
- version/gnu emacs/20.1
- version/gnu emacs/20.2
- version/gnu emacs/20.3
- version/gnu emacs/20.4
- version/gnu emacs/20.5
- version/gnu emacs/20.6
- version/gnu emacs/20.7
- version/gnu emacs/21
- version/gnu emacs/21.1
- version/gnu emacs/21.2
- version/gnu emacs/21.2.1
- version/gnu emacs/21.3
- version/gnu emacs/21.3.1
- version/gnu emacs/21.4
- version/gnu emacs/22.1
- version/gnu emacs/22.2
- version/gnu emacs/22.3
- version/gnu emacs/23.1
- version/gnu emacs/23.2
- version/gnu emacs/23.4