Vulnerabilities > GNU
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-05-08 | CVE-2014-3424 | Link Following vulnerability in multiple products lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file. | 3.3 |
| 2014-05-08 | CVE-2014-3423 | Link Following vulnerability in multiple products lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file. | 3.3 |
| 2014-05-08 | CVE-2014-3422 | Link Following vulnerability in multiple products lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/. | 3.3 |
| 2014-05-08 | CVE-2014-3421 | Link Following vulnerability in multiple products lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file. | 3.3 |
| 2014-04-05 | CVE-2001-1593 | Link Following vulnerability in GNU A2Ps The tempname_ensure function in lib/routines.h in a2ps 4.14 and earlier, as used by the spy_user function and possibly other functions, allows local users to modify arbitrary files via a symlink attack on a temporary file. | 2.1 |
| 2014-04-03 | CVE-2014-0466 | Arbitrary Command Execution vulnerability in GNU A2Ps 4.14 The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file. network gnu | 6.8 |
| 2014-03-07 | CVE-2014-1959 | Permissions, Privileges, and Access Controls vulnerability in GNU Gnutls lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates. | 5.8 |
| 2014-03-07 | CVE-2014-0092 | Cryptographic Issues vulnerability in GNU Gnutls lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate. | 5.8 |
| 2014-03-07 | CVE-2009-5138 | Permissions, Privileges, and Access Controls vulnerability in GNU Gnutls GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959. | 5.8 |
| 2014-02-10 | CVE-2012-3406 | Permissions, Privileges, and Access Controls vulnerability in multiple products The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405. | 6.8 |