Description
Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | emacs | 25.1-1.1 | openSUSE-SU-2024:10469-1 |
Advisories 1
- openSUSE-SU-2024:10469-1 emacs-25.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [oss-security] 20120109 CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability mailing-list
- [cedet-devel] 20120111 CEDET 1.0.1 available online mailing-list
- 47311 third-party-advisory
- 50801 third-party-advisory
- [oss-security] 20120109 Re: Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability mailing-list
- 47515 third-party-advisory
- [cedet-devel] 20120109 Security flaw in EDE mailing-list
- USN-1586-1 vendor-advisory
- MDVSA-2013:076 vendor-advisory
- FEDORA-2012-0462 vendor-advisory
- FEDORA-2012-0494 vendor-advisory
- GLSA-201812-05 vendor-advisory
- [emacs-devel] 20120109 Security flaw in EDE; new release plans mailing-list