fkie_cve-2012-0035
Vulnerability from fkie_nvd
Published
2012-01-19 15:55
Modified
2025-04-11 00:51
Severity ?
Summary
Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
References
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html
secalert@redhat.comhttp://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html
secalert@redhat.comhttp://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.htmlPatch
secalert@redhat.comhttp://openwall.com/lists/oss-security/2012/01/10/2Patch
secalert@redhat.comhttp://openwall.com/lists/oss-security/2012/01/10/4
secalert@redhat.comhttp://secunia.com/advisories/47311Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/47515Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/50801
secalert@redhat.comhttp://sourceforge.net/mailarchive/message.php?msg_id=28649762
secalert@redhat.comhttp://sourceforge.net/mailarchive/message.php?msg_id=28657612
secalert@redhat.comhttp://www.mandriva.com/security/advisories?name=MDVSA-2013:076
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-1586-1
secalert@redhat.comhttps://security.gentoo.org/glsa/201812-05
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html
af854a3a-2127-422b-91ae-364da2661108http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html
af854a3a-2127-422b-91ae-364da2661108http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.htmlPatch
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2012/01/10/2Patch
af854a3a-2127-422b-91ae-364da2661108http://openwall.com/lists/oss-security/2012/01/10/4
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47311Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/47515Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/50801
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/mailarchive/message.php?msg_id=28649762
af854a3a-2127-422b-91ae-364da2661108http://sourceforge.net/mailarchive/message.php?msg_id=28657612
af854a3a-2127-422b-91ae-364da2661108http://www.mandriva.com/security/advisories?name=MDVSA-2013:076
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1586-1
af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201812-05
Impacted products
Vendor Product Version
eric_m_ludlam cedet *
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
eric_m_ludlam cedet 1.0
gnu emacs *
gnu emacs 20.0
gnu emacs 20.1
gnu emacs 20.2
gnu emacs 20.3
gnu emacs 20.4
gnu emacs 20.5
gnu emacs 20.6
gnu emacs 20.7
gnu emacs 21
gnu emacs 21.1
gnu emacs 21.2
gnu emacs 21.2.1
gnu emacs 21.3
gnu emacs 21.3.1
gnu emacs 21.4
gnu emacs 22.1
gnu emacs 22.2
gnu emacs 22.3
gnu emacs 23.1
gnu emacs 23.2
gnu emacs 23.4


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "81840C8F-0D7C-46B0-8BF2-328DF34AD6B5",
              "versionEndIncluding": "1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7A64840D-EDD2-4776-8F76-108A85604524",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "AD9BFD76-DBD0-4FA7-AC95-9ED86F041840",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "C249F7CC-3524-4CA2-B838-F659B825BB1D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre1:*:*:*:*:*:*",
              "matchCriteriaId": "97721CF9-7FE5-4A35-9982-7A358D707149",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre2:*:*:*:*:*:*",
              "matchCriteriaId": "98E05598-6322-4EAA-9BFF-B8A7DE63E959",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre3:*:*:*:*:*:*",
              "matchCriteriaId": "D62A1EF8-7EF8-4AEA-91A9-F47FD72D52DD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre4:*:*:*:*:*:*",
              "matchCriteriaId": "814A737D-C0C5-405E-AFF6-EB554AE4151A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre6:*:*:*:*:*:*",
              "matchCriteriaId": "40CF2404-803C-478C-9111-FFA9173C89B7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:eric_m_ludlam:cedet:1.0:pre7:*:*:*:*:*:*",
              "matchCriteriaId": "A30EB0E8-2CB4-4EC5-A280-3CF3BDBEC969",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D2680B3-7AE8-47E3-9027-9CFB19292AC4",
              "versionEndIncluding": "23.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E460F3A1-71DD-4A37-9F17-6B4E5C9A46AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F9D5B3C-7534-4DC6-BE44-91A0031FBA6C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "4EB2E29F-371A-43AB-8CBF-DDFABDB103BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "05F6124D-F3C1-4E4C-B580-85AB01833885",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "9571E866-AB82-4B95-8097-ED0DA038331F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A773690-9650-40E1-BCE3-7E020AF61BCD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "26D9A554-CB40-461D-9C95-78051B0CA354",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:20.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "0AFE5D6E-1979-4CF2-ACE0-BB6F31F80434",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21:*:*:*:*:*:*:*",
              "matchCriteriaId": "7731A395-328A-4435-A388-1419224A4256",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "05BDDB87-0AFF-4BDC-995A-94F221ED3641",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9ADBEE6-3B38-4284-B9F8-37F7FFEBDE81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4389884-70D2-4915-80A7-CFA4A420A024",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA95B19B-F35D-4644-9E75-5A138A960C10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE5CB6EB-74D8-4CA8-8B86-08E06859E2E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:21.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC7E9FE5-E87C-440B-A16E-327501BC8977",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9ADF55EE-0F79-414A-B701-14DDA1C9C3B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "37E5A757-C2C8-49D4-AFCD-156CCF4B7262",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F1D047EC-2354-430D-B44C-FE8574F7617B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:23.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "99B66AEA-D831-4A17-A7D6-4DEDA28985C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:23.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "944A2F7B-375B-4466-8A98-934123C209FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:23.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9948287-D8A4-4B29-9240-FCD25E73B00D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de ruta de b\u00fasqueda no confiable en EDE en CEDET antes de v1.0.1, tal como se utiliza en GNU Emacs antes de v23.4 y otros productos, permite a usuarios locales conseguir privilegios a trav\u00e9s de una expresi\u00f3n Lisp modificada en un archivo Project.ede en el directorio, o en el directorio padre, de un archivo abierto."
    }
  ],
  "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/426.html\r\n\r\n\u0027CWE-426: Untrusted Search Path\u0027",
  "id": "CVE-2012-0035",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2012-01-19T15:55:00.943",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2012/01/10/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://openwall.com/lists/oss-security/2012/01/10/4"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47311"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47515"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/50801"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28649762"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28657612"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:076"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-1586-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://security.gentoo.org/glsa/201812-05"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://openwall.com/lists/oss-security/2012/01/10/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://openwall.com/lists/oss-security/2012/01/10/4"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47311"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/47515"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/50801"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28649762"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sourceforge.net/mailarchive/message.php?msg_id=28657612"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2013:076"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1586-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.gentoo.org/glsa/201812-05"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.