Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.

The hack-local-variable function in Emacs 22 prior to version 22.2, when enable-local-variables is set to ':safe', did not properly search lists of unsafe or risky variables, which could allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a Local variables declaration (CVE-2007-5795; only affects Mandriva Linux 2008.0).

A stack-based buffer overflow in emacs could allow user-assisted attackers to cause an application crash or possibly have other unspecified impacts via a large precision value in an integer format string specifier to the format function (CVE-2007-6109).

The updated packages have been patched to correct these issues.

It was discovered that Emacs did not account for precision when formatting integers. If a user were tricked into opening a specially crafted file, an attacker could cause a denial of service or possibly other unspecified actions. This issue does not affect Ubuntu 8.04.
(CVE-2007-6109)

Steve Grubb discovered that the vcdiff script as included in Emacs created temporary files in an insecure way when used with SCCS. Local users could exploit a race condition to create or overwrite files with the privileges of the user invoking the program. (CVE-2008-1694).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

This update fixes a buffer overflow in xemacs. (CVE-2007-6109)

The remote host is affected by the vulnerability described in GLSA-200712-03 (GNU Emacs: Multiple vulnerabilities)

    Drake Wilson reported that the hack-local-variables() function in GNU     Emacs 22 does not properly match assignments of local variables in a     file against a list of unsafe or risky variables, allowing to override     them (CVE-2007-5795). Andreas Schwab (SUSE) discovered a stack-based     buffer overflow in the format function when handling values with high     precision (CVE-2007-6109).
  Impact :

    Remote attackers could entice a user to open a specially crafted file     in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp     code (via CVE-2007-5795) or arbitrary code (via CVE-2007-6109) with the     privileges of the user running GNU Emacs.
  Workaround :

    The first vulnerability can be worked around by setting the     'enable-local-variables' option to 'nil', disabling the processing of     local variable lists. GNU Emacs prior to version 22 is not affected by     this vulnerability. There is no known workaround for the second     vulnerability at this time.

ID	Name	Product	Family	Severity
36420	Mandriva Linux Security Advisory : emacs (MDVSA-2008:034)	Nessus	Mandriva Local Security Checks	critical
32187	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : emacs21, emacs22 vulnerabilities (USN-607-1)	Nessus	Ubuntu Local Security Checks	critical
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
30096	openSUSE 10 Security Update : xemacs (xemacs-4944)	Nessus	SuSE Local Security Checks	critical
29290	GLSA-200712-03 : GNU Emacs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2007-6109

high

Tenable Plugins

critical

critical

critical

critical

critical