vulnwire
5.1med

CVE-2003-12321 exploit

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-a…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
5.1
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
1
Exploit-DB

Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable.

Exploit prediction (EPSS)

3.01% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

Exploits and detections

  • EDB-26492 Emacs 2.1 - Local Variable Arbitrary Command Execution · local · 2002-12-31

CVSS scores

Assigned byVersionScoreVector
NVD2.05.1AV:N/AC:H/Au:N/C:P/I:P/A:P

References

  • groups.google.com /group/gnu.emacs.bug/browse_frm/thread/9424ec1b2fdae321/c691a2da8904db0f?hl=en&lr=&ie=UTF- · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/15375 · vdb-entry, x_refsource_BID, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2005:208 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
  • secunia.com /advisories/17496 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=286183 · x_refsource_CONFIRM, x_transferred
  • lists.grok.org.uk /pipermail/full-disclosure/2003-May/005089.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.