PT-2017-10957 · Gnu · Gnu Emacs

Published 2017-10-31 · Updated 2017-11-27 · CVE-2017-1000383

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GNU Emacs version 25.3.1

Description The issue concerns GNU Emacs ignoring umask when creating a backup save file, resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.

Recommendations For GNU Emacs version 25.3.1, consider adjusting the umask setting manually to ensure backup files are created with the intended permissions until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-1000383

Affected Products

Gnu Emacs

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000383 · Security Note
• https://ubuntu.com/security/CVE-2017-1000383 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000383 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-1000383 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000383 · Vendor Advisory
• http://openwall.com/lists/oss-security/2017/10/31/1 · Note
• http://securityfocus.com/bid/101671 · Note
• http://openwall.com/lists/oss-security/2017/10/31/15 · Note