2.1
CVSSv2

CVE-2017-1000383

Published: 31/10/2017 Updated: 27/11/2017
CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9
CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8
VMScore: 187
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

GNU Emacs version 25.3.1 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary.

Vulnerable Product Search on Vulmon Subscribe to Product

gnu emacs

Vendor Advisories

It was found that emacs applies the opened file read permissions to the swap file, overriding the process' umask An attacker might search for vim swap files, that were not deleted properly, in order to retrieve sensible data ...
GNU Emacs version 2531 (and other versions most likely) ignores umask when creating a backup save file ("[ORIGINAL_FILENAME]~") resulting in files that may be world readable or otherwise accessible in ways not intended by the user running the emacs binary An attacker might search for emacs backup save files in order to retrieve security sensible ...