CVE-2012-3479 Code injection in n/a

Medium 6.8 Published 25 Aug 2012 Updated 6 Aug 2024

Attackers can execute arbitrary Emacs Lisp code by tricking users into opening crafted files when local variables are enabled in safe mode.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2012-3479?

CVE-2012-3479 is a medium-severity code injection vulnerability in n/a, published on 25 Aug 2012. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.

Which versions are affected by CVE-2012-3479?

It affects 1 product.

Products include Gnu Emacs.

How do I fix CVE-2012-3479?

Apply the vendor's patch.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2012-3479 being exploited?

There is no known exploitation of CVE-2012-3479 in the wild and no public exploit code.

Sources

Also known as DSA-2603-1, GHSA-fh9m-xg7x-wmp2.