CVE-2014-3424

Severity: low (CVSS 3.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-08 · updated 2026-06-17
Weakness: CWE-59

Description

lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.

Affected products

GNU Emacs: through 24.3; 20.0, 20.1, 20.2, 20.3, 20.4, 20.5 (+18)
Mageia Project Mageia: 3, 4

References

http://advisories.mageia.org/MGASA-2014-0250.html
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8
http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00060.html
http://openwall.com/lists/oss-security/2014/05/07/7
http://www.mandriva.com/security/advisories?name=MDVSA-2015:117
http://advisories.mageia.org/MGASA-2014-0250.html
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8
http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00060.html
http://openwall.com/lists/oss-security/2014/05/07/7
http://www.mandriva.com/security/advisories?name=MDVSA-2015:117

Get alerted when CVE-2014-3424 or the next vulnerability affects your stack