Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 325553 (CVE-2010-0825) - virtual/emacs: symlink attacks (CVE-2010-0825)
Summary: virtual/emacs: symlink attacks (CVE-2010-0825)
Status: RESOLVED INVALID
Alias: CVE-2010-0825
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: https://bugs.launchpad.net/ubuntu/+bu...
Whiteboard: A3 [invalid]
Keywords:
Depends on:
Blocks:
 
Reported: 2010-06-25 19:25 UTC by Stefan Behte (RETIRED)
Modified: 2010-06-26 12:27 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stefan Behte (RETIRED) gentoo-dev Security 2010-06-25 19:25:48 UTC 
CVE-2010-0825 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0825):
  lib-src/movemail.c in movemail in emacs 22 and 23 allows local users
  to read, modify, or delete arbitrary mailbox files via a symlink
  attack, related to improper file-permission checks.
Comment 1 Ulrich Müller gentoo-dev 2010-06-25 20:38:24 UTC 
Since none of the Emacs ebuilds installs the movemail program with a setuid or setgid bit, we are not affected. See also Redhat's statement at NVD.
Comment 2 Stefan Behte (RETIRED) gentoo-dev Security 2010-06-25 21:37:03 UTC 
CVE-2010-0825 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0825):
  lib-src/movemail.c in movemail in emacs 22 and 23 allows local users
  to read, modify, or delete arbitrary mailbox files via a symlink
  attack, related to improper file-permission checks.