« Volver al listado

CVE-2010-0825

Estado: ModificadaMedia (4.4)—

lib-src/movemail.c in movemail in emacs 22 and 23 allows local users to read, modify, or delete arbitrary mailbox files via a symlink attack, related to improper file-permission checks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

GNU — Emacs

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-0825",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "security@ubuntu.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-04-05T15:30:01.140",
  "references": [
    {
      "url": "http://secunia.com/advisories/39155",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:083",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-919-1",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0734",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0952",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+bug/531569",
      "source": "security@ubuntu.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57457",
      "source": "security@ubuntu.com"
    },
    {
      "url": "http://secunia.com/advisories/39155",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:083",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-919-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0734",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2010/0952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/ubuntu/+bug/531569",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/57457",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "lib-src/movemail.c in movemail in emacs 22 and 23 allows local users to read, modify, or delete arbitrary mailbox files via a symlink attack, related to improper file-permission checks."
    },
    {
      "lang": "es",
      "value": "El fichero lib-src/movemail.c en la función movemail de emacs v22 y v23 permite a usuarios locales leer, modificar o borrar archivos de buzón aleatorios mediante un ataque de enlace simbólico, ocasionado por una comprobacion inadecuada de permisos de archivos."
    }
  ],
  "lastModified": "2026-06-16T23:16:54.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9ADF55EE-0F79-414A-B701-14DDA1C9C3B5"
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37E5A757-C2C8-49D4-AFCD-156CCF4B7262"
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:22.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1D047EC-2354-430D-B44C-FE8574F7617B"
            },
            {
              "criteria": "cpe:2.3:a:gnu:emacs:23.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "99B66AEA-D831-4A17-A7D6-4DEDA28985C2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "vendorComments": [
    {
      "comment": "Not vulnerable. This issues does not affect the versions of emacs or xemacs as shipped with Red Hat Enterprise Linux. The movemail utility in Red Hat Enterprise Linux does not have the setgid bit set, which is required for this flaw to be exploitable.\n",
      "lastModified": "2010-04-06T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com"
}