CVE-2017-1000383: Infoleak
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINALFILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-1000383?
CVE-2017-1000383 is considered a medium severity vulnerability due to the potential exposure of sensitive data.
How do I fix CVE-2017-1000383?
Updating GNU Emacs to version 25.3.1 or later will resolve the issue as it addresses the umask ignoring behavior.
Which versions of GNU Emacs are affected by CVE-2017-1000383?
GNU Emacs versions prior to 25.3.1, including version 25.3.0, are affected by CVE-2017-1000383.
What does CVE-2017-1000383 impact?
CVE-2017-1000383 impacts the backup save files created by GNU Emacs, which may become world-readable.
Can CVE-2017-1000383 lead to data exposure?
Yes, CVE-2017-1000383 can lead to unintended data exposure, allowing unauthorized access to backup save files.