CVE-2008-1688 Code injection in n/a

High 7.5 Published 9 Apr 2008 Updated 7 Aug 2024

Attackers may execute arbitrary code via improper handling of filenames in the -F option of GNU m4.

Exploited in the wild: Not known
Login needed: Not stated
Attackable: Not stated
Victim action needed: Not stated
Fix: Available

What is CVE-2008-1688?

CVE-2008-1688 is a high-severity code injection vulnerability in n/a, published on 9 Apr 2008.

Official description

Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries.

Which versions are affected by CVE-2008-1688?

It affects 1 product.

Products include Gnu M4.

How do I fix CVE-2008-1688?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2008-1688 being exploited?

There is no known exploitation of CVE-2008-1688 in the wild and no public exploit code.

CVE-2008-1687 Other in n/a High 7.5

Sources

Also known as DEBIAN-CVE-2008-1688, ECHO-2a21-79f8-f2c6, GHSA-rq5m-h657-fcmc, ROOT-OS-DEBIAN-12-CVE-2008-1688.