CVE-2008-3949

Published: Sep 22, 2008Modified: Apr 23, 2026

7.2

Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability: 3.9 / Impact: 10.0

Source: NVD

Description

emacs/lisp/progmodes/python.el in Emacs 22.1 and 22.2 imports Python script from the current working directory during editing of a Python file, which allows local users to execute arbitrary code via a Trojan horse Python file.

Affected (1)

Products: Suse: Suse Linux

Suse

1 product

Suse Linux

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Suse Suse Linux	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (18)

http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html

Source: cve@mitre.org

http://secunia.com/advisories/31982

Source: cve@mitre.org

http://secunia.com/advisories/34004

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200902-06.xml

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:216

Source: cve@mitre.org

http://www.securityfocus.com/bid/31052

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=424340

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/45021

Source: cve@mitre.org

http://lists.gnu.org/archive/html/emacs-devel/2008-09/msg00215.html