Read the docs
TI-2014-02752 Aliases CVE-2014-3421GHSA-3v7q-6w55-588c

lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite…

Priority LOW 16CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file.

Why it matters now

EPSS 0.00344 28th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:o:mageia_project:mageia:3:*:*:*:*:*:*:*3VulnerableMageia Project
cpe:2.3:o:mageia_project:mageia:4:*:*:*:*:*:*:*4VulnerableMageia Project
cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*up to 24.3VulnerableGNU
cpe:2.3:a:gnu:emacs:20.0:*:*:*:*:*:*:*20.0VulnerableGNU
cpe:2.3:a:gnu:emacs:20.1:*:*:*:*:*:*:*20.1VulnerableGNU
cpe:2.3:a:gnu:emacs:20.2:*:*:*:*:*:*:*20.2VulnerableGNU
cpe:2.3:a:gnu:emacs:20.3:*:*:*:*:*:*:*20.3VulnerableGNU
cpe:2.3:a:gnu:emacs:20.4:*:*:*:*:*:*:*20.4VulnerableGNU
cpe:2.3:a:gnu:emacs:20.5:*:*:*:*:*:*:*20.5VulnerableGNU
cpe:2.3:a:gnu:emacs:20.6:*:*:*:*:*:*:*20.6VulnerableGNU
  • cpe:2.3:o:mageia_project:mageia:3:*:*:*:*:*:*:* Versions 3 Vulnerable ·Mageia Project
  • cpe:2.3:o:mageia_project:mageia:4:*:*:*:*:*:*:* Versions 4 Vulnerable ·Mageia Project
  • cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:* Versions up to 24.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.0:*:*:*:*:*:*:* Versions 20.0 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.1:*:*:*:*:*:*:* Versions 20.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.2:*:*:*:*:*:*:* Versions 20.2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.3:*:*:*:*:*:*:* Versions 20.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.4:*:*:*:*:*:*:* Versions 20.4 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.5:*:*:*:*:*:*:* Versions 20.5 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:20.6:*:*:*:*:*:*:* Versions 20.6 Vulnerable ·GNU
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gnu:emacs:20.7:*:*:*:*:*:*:*20.7VulnerableGNU
cpe:2.3:a:gnu:emacs:21:*:*:*:*:*:*:*21VulnerableGNU
cpe:2.3:a:gnu:emacs:21.1:*:*:*:*:*:*:*21.1VulnerableGNU
cpe:2.3:a:gnu:emacs:21.2:*:*:*:*:*:*:*21.2VulnerableGNU
cpe:2.3:a:gnu:emacs:21.2.1:*:*:*:*:*:*:*21.2.1VulnerableGNU
cpe:2.3:a:gnu:emacs:21.3:*:*:*:*:*:*:*21.3VulnerableGNU
cpe:2.3:a:gnu:emacs:21.3.1:*:*:*:*:*:*:*21.3.1VulnerableGNU
cpe:2.3:a:gnu:emacs:21.4:*:*:*:*:*:*:*21.4VulnerableGNU
cpe:2.3:a:gnu:emacs:22.1:*:*:*:*:*:*:*22.1VulnerableGNU
cpe:2.3:a:gnu:emacs:22.2:*:*:*:*:*:*:*22.2VulnerableGNU
cpe:2.3:a:gnu:emacs:22.3:*:*:*:*:*:*:*22.3VulnerableGNU
cpe:2.3:a:gnu:emacs:23.1:*:*:*:*:*:*:*23.1VulnerableGNU
cpe:2.3:a:gnu:emacs:23.2:*:*:*:*:*:*:*23.2VulnerableGNU
cpe:2.3:a:gnu:emacs:23.3:*:*:*:*:*:*:*23.3VulnerableGNU
cpe:2.3:a:gnu:emacs:23.4:*:*:*:*:*:*:*23.4VulnerableGNU
cpe:2.3:a:gnu:emacs:24.1:*:*:*:*:*:*:*24.1VulnerableGNU
cpe:2.3:a:gnu:emacs:24.2:*:*:*:*:*:*:*24.2VulnerableGNU
  • cpe:2.3:a:gnu:emacs:20.7:*:*:*:*:*:*:* Versions 20.7 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21:*:*:*:*:*:*:* Versions 21 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.1:*:*:*:*:*:*:* Versions 21.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.2:*:*:*:*:*:*:* Versions 21.2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.2.1:*:*:*:*:*:*:* Versions 21.2.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.3:*:*:*:*:*:*:* Versions 21.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.3.1:*:*:*:*:*:*:* Versions 21.3.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:21.4:*:*:*:*:*:*:* Versions 21.4 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:22.1:*:*:*:*:*:*:* Versions 22.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:22.2:*:*:*:*:*:*:* Versions 22.2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:22.3:*:*:*:*:*:*:* Versions 22.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:23.1:*:*:*:*:*:*:* Versions 23.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:23.2:*:*:*:*:*:*:* Versions 23.2 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:23.3:*:*:*:*:*:*:* Versions 23.3 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:23.4:*:*:*:*:*:*:* Versions 23.4 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:24.1:*:*:*:*:*:*:* Versions 24.1 Vulnerable ·GNU
  • cpe:2.3:a:gnu:emacs:24.2:*:*:*:*:*:*:* Versions 24.2 Vulnerable ·GNU

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-3421
  2. 2026-10-03 Alias added: GHSA-3v7q-6w55-588c

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences