Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2008-4952: Emacs‑jabber lets local user replace any file
CVE-2008-4952 · published 18 years ago
Summary
The emacs‑jabber program (version 0.7.91) creates temporary log files in the /tmp directory. A local user can trick the program into following a symbolic link and overwrite any file they choose. Update to a newer version or apply the vendor's patch to stop this behavior.
What to do
- Update debian emacs-jabber to version 0.7.91-2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | emacs-jabber |
< 0.7.91-2 Fix: upgrade to 0.7.91-2
|
| Debian:13 | debian | emacs-jabber |
< 0.7.91-2 Fix: upgrade to 0.7.91-2
|
| Debian:14 | debian | emacs-jabber |
< 0.7.91-2 Fix: upgrade to 0.7.91-2
|
| – | emacs | emacs-jabber |
0.7.91 cpe:2.3:a:emacs:emacs-jabber:0.7.91:*:*:*:*:*:*:* |
Original advisory text
emacs-jabber in emacs-jabber 0.7.91 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.log temporary file.
emacs-jabber in emacs-jabber 0.7.91 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/*.log temporary file.
References
- https://security-tracker.debian.org/tracker/CVE-2008-4952 Vendor Advisory
- http://bugs.debian.org/496428
- http://dev.gentoo.org/~rbu/security/debiantemp/emacs-jabber Exploit
- http://www.openwall.com/lists/oss-security/2008/10/30/2
- https://bugs.gentoo.org/show_bug.cgi?id=235770
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46409
Severity
6.9
Medium
Type
CWE-59Link Following
Timeline
Published5 Nov 2008
Updated4 Nov 2026
First seen20 Sep 2026
Track software like this
Free during beta