CVE-2012-0035

Description

Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.

9.3

CVSS

Severity: Critical

CVSS 2.0 •

EPSS 4.03% Top 15%

Vendor Advisory ubuntu.com Vendor Advisory mandriva.com Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory gentoo.org Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://openwall.com/lists/oss-security/2012/01/10/2	patch mailing list
http://sourceforge.net/mailarchive/message.php?msg_id=28657612	mailing list
http://secunia.com/advisories/47311	third party advisory vendor advisory
http://secunia.com/advisories/50801	third party advisory
http://openwall.com/lists/oss-security/2012/01/10/4	mailing list
http://secunia.com/advisories/47515	third party advisory vendor advisory
http://sourceforge.net/mailarchive/message.php?msg_id=28649762	mailing list
http://www.ubuntu.com/usn/USN-1586-1	vendor advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2013:076	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072285.html	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-January/072288.html	vendor advisory
https://security.gentoo.org/glsa/201812-05	vendor advisory
http://lists.gnu.org/archive/html/emacs-devel/2012-01/msg00387.html	patch mailing list

Frequently Asked Questions

What is the severity of CVE-2012-0035?: CVE-2012-0035 has been scored as a critical severity vulnerability.
How to fix CVE-2012-0035?: To fix CVE-2012-0035, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2012-0035 being actively exploited in the wild?: It is possible that CVE-2012-0035 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~4% probability that this vulnerability will be exploited by malicious actors in the next 30 days.