Unscored CVE-2014-4150 EUVD-2014-4081GHSA-7r76-9rwv-q8jp

The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on…

Published Jul 20, 2018 · Updated Aug 6, 2024 · Assigned by debian

Description

The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on /tmp/s48lose.tmp.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	scheme48	1.9-4	—
Debian 13	scheme48	1.9-4	—
Debian 12	scheme48	1.9-4	—
Debian 6.0	scheme48	1.8+dfsg-1+deb6u1	DLA-0006-1

Advisories 1

DLA-0006-1 scheme48 - security update Debian Security (DSA / DLA) · Mar 9, 2026

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=748766
http://www.s48.org/cgi-bin/hgwebdir.cgi/s48/rev/a44624256297
[oss-security] 20140613 Re: CVE request: scheme48: insecure use of temporary files in cmuscheme48.el mailing-list
67654 vdb-entry