FKIE_CVE-2008-1688

Vulnerability from fkie_nvd - Published: 2008-04-09 19:05 - Updated: 2026-06-16 22:52
Severity
Summary
Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option. NOTE: it is not clear when this issue crosses privilege boundaries.
References
cve@mitre.orghttp://osvdb.org/44272
cve@mitre.orghttp://secunia.com/advisories/29671Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/29729Patch, Vendor Advisory
cve@mitre.orghttp://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/04/07/1
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2008/04/07/3
cve@mitre.orghttp://www.securityfocus.com/bid/28688
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/1151/references
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41704
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/44272
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29671Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29729Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/04/07/1
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2008/04/07/3
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28688
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/1151/references
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41704
Impacted products
Vendor Product Version
gnu m4 1.4.1
gnu m4 1.4.2
gnu m4 1.4.3
gnu m4 1.4.4
gnu m4 1.4.5
gnu m4 1.4.6
gnu m4 1.4.7
gnu m4 1.4.8
gnu m4 1.4.9
gnu m4 1.4.10
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5157211A-80A7-4694-9D45-E1C4CA9DA2C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E10A3A6-8DC0-4BFD-8C4F-4B6B7C5EC03B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "77C4D372-B593-4AF4-A2C1-A5F1657B28EE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "964FCBD7-B697-4D9A-AD73-F5ED3631FBB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BE99BE1-1956-41DB-8E9C-684D3040CEAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "96348B9C-BB73-404D-8A68-0A96B793BC3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F6DD41B-D8EF-4D1E-B939-9CB0D85D8217",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "C62D0160-F302-43A4-A244-DFD92BC9FD49",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "886BBA7D-DE20-4A47-9896-E71BA25E9205",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:gnu:m4:1.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "3AF0E0A6-401D-4306-88EC-5FFD207C39BF",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in GNU m4 before 1.4.11 might allow context-dependent attackers to execute arbitrary code, related to improper handling of filenames specified with the -F option.  NOTE: it is not clear when this issue crosses privilege boundaries."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en GNU m4 versiones anteriores a 1.4.11 podr\u00eda permitir a  atacantes dependientes de contexto ejecutar c\u00f3digo se su elecci\u00f3n, relacionado con el manejo no apropiado de nombres de ficheros espec\u00edficados con la opci\u00f3n -F.\r\nNOTA: no est\u00e1 claro cuando esta cuesti\u00f3n cruza fronteras de privilegios.\r\n\r\n"
    }
  ],
  "id": "CVE-2008-1688",
  "lastModified": "2026-06-16T22:52:16.403",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 7.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-04-09T19:05:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/44272"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29671"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29729"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.510612"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2008/04/07/1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.openwall.com/lists/oss-security/2008/04/07/3"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28688"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/1151/references"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41704"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/44272"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29671"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29729"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.510612"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2008/04/07/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2008/04/07/3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28688"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/1151/references"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41704"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vendorComments": [
    {
      "comment": "Red Hat does not consider this to be a security issue.  After careful analysis of this issue the Red Hat Security Response Team has determined that this bug has no security impact outside of expected m4 behavior.",
      "lastModified": "2008-04-15T00:00:00",
      "organization": "Red Hat"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.