PT-2008-3233 · Gnu+1 · Gnu M4+1

Patrick J. Volkerding · Published 2008-04-09 · Updated 2025-08-19 · CVE-2008-1687

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GNU m4 versions prior to 1.4.11

Description The issue concerns the maketemp and mkstemp builtin functions in GNU m4, which do not quote their output when a file is created. This could allow attackers to trigger a macro expansion, potentially leading to the use of an incorrect filename.

Recommendations For GNU m4 versions prior to 1.4.11, update to version 1.4.11 or later to resolve the issue.

Fix

Related Identifiers

CVE-2008-1687

ECHO-8F1C-8D22-666A

Affected Products

Debian

Gnu M4

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2008-1687 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2008-1687 · Vendor Advisory
• http://secunia.com/advisories/29671 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612 · Vendor Advisory
• http://secunia.com/advisories/29729 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-1687 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-1687 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-1687 · Vendor Advisory
• http://openwall.com/lists/oss-security/2008/04/07/4 · Note
• http://openwall.com/lists/oss-security/2008/04/07/3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41706 · Note
• http://securityfocus.com/bid/28688 · Note
• http://vupen.com/english/advisories/2008/1151/references · Note
• http://openwall.com/lists/oss-security/2008/04/07/1 · Note
• http://openwall.com/lists/oss-security/2008/04/07/12 · Note