CVE-2007-6109

Summary

CVE	CVE-2007-6109
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2007-12-07 11:46:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.

Risk And Classification

Primary CVSS: v2.0 10 from [email protected]

AV:N/AC:L/Au:N/C:C/I:C/A:C

Problem Types: CWE-119 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Gnu	Emacs	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
SUSE Update for Multiple Packages - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com
Support / Security / Advisories / / MDVSA-2008:034 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com
Mac OS X Security Update Fixes Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com
About Security Update 2008-002	af854a3a-2127-422b-91ae-364da2661108	docs.info.apple.com
[security-announce] SUSE Security Summary Report SUSE-SR:2008:003	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org
404 Page Not Found \| SUSE	af854a3a-2127-422b-91ae-364da2661108	www.novell.com
SUSE Update for Multiple Packages - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com
Ubuntu update for emacs - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com
Gentoo Bug 200297 - app-editors/emacs < 22.1-r3 Buffer overflow in format function (CVE-2007-6109)	af854a3a-2127-422b-91ae-364da2661108	bugs.gentoo.org
Gentoo Linux Documentation -- GNU Emacs: Multiple vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org
APPLE-SA-2008-03-18 Security Update 2008-002	af854a3a-2127-422b-91ae-364da2661108	lists.apple.com
USN-607-1: Emacs vulnerabilities \| Ubuntu security notices	af854a3a-2127-422b-91ae-364da2661108	usn.ubuntu.com
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
Gentoo update for emacs - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Organization	Published	Contributor	Statement
Red Hat	2007-12-11	Mark J Cox	Red Hat does not consider this issue to be a security vulnerability since no trust boundary is crossed. The user must voluntarily interact with the attack mechanism to exploit this flaw, with the result being the ability to run code as themselves.

Legacy QID Mappings

902235 Common Base Linux Mariner (CBL-Mariner) Security Update for emacs (9919)
906311 Common Base Linux Mariner (CBL-Mariner) Security Update for emacs (9919-2)