Описание
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
It was found that emacs applies the opened file read permissions to the swap file, overriding the process' umask. An attacker might search for vim swap files, that were not deleted properly, in order to retrieve sensible data.
Отчет
This flaw is an incorrect permission assignment, where the application ignores the user's umask setting when creating a backup file (e.g., filename~).This behavior is triggered during normal file-saving operations. On a multi-user system, this could allow an unprivileged local user to read the contents of backup files created by other users. This results in a low-impact information disclosure of the file's previous contents, the practical impact is limited to these specific shared-environment scenarios and does not allow an attacker to modify data or execute code.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | emacs | Will not fix | ||
| Red Hat Enterprise Linux 6 | emacs | Will not fix | ||
| Red Hat Enterprise Linux 7 | emacs | Will not fix | ||
| Red Hat Enterprise Linux 9 | emacs | Affected |
Показывать по
Дополнительная информация
Статус:
5.5 Medium
CVSS3
Связанные уязвимости
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
GNU Emacs version 25.3.1 (and other versions most likely) ignores umas ...
GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.
5.5 Medium
CVSS3