CVE-2012-3479: Medium severity gnu Emacs vulnerability

Published Aug 25, 2012

Updated

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.

Affected Software

4 affected components

gnu Emacs=23.2

gnu Emacs=23.3

gnu Emacs=23.4

gnu Emacs=24.1

Remediation

Patch Available

http://www.openwall.com/lists/oss-security/2012/08/13/1

Event History

Aug 25, 2012

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3479?

CVE-2012-3479 has a moderate severity level, as it allows for arbitrary code execution through user-assisted methods.

How does CVE-2012-3479 affect Emacs users?

CVE-2012-3479 affects users by allowing crafted files to execute arbitrary Emacs Lisp code, compromising the user's environment.

How do I fix CVE-2012-3479?

To fix CVE-2012-3479, upgrade to a non-vulnerable version of Emacs that is beyond 24.1.

Which versions of Emacs are affected by CVE-2012-3479?

CVE-2012-3479 affects Emacs versions 23.2, 23.3, 23.4, and 24.1.

Can CVE-2012-3479 be exploited without user interaction?

CVE-2012-3479 cannot be exploited without user interaction, as it requires the user to open a malicious file.