CVE-2008-1687
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...
CVE-2008-1687 is a high vulnerability (CVSS 7.5) in Gnu M4, published April 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in m4 1.4.19-3.root.io.2.
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
Exploit likelihood
What each source reports
NVD Score used
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- Updated
- 2026-11-02
EUVDEUVD-2008-1688 No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
EUVD-2008-1688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r86c-jfhj-2f8j No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
GHSA-r86c-jfhj-2f8j- Updated
- 2026-11-02
OSV No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1687 No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
DEBIAN-CVE-2008-1687- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2008-1687 No score
CVE-2008-1687 in m4 - Patched by Root
Root has patched CVE-2008-1687 in the m4 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2008-1687- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
m4Debian:12 |
All versions, plus listed versions 1.4.19-31.4.19-41.4.19-4+hurd.11.4.19-51.4.19-6 Show 5 moreShow less1.4.19-71.4.19-81.4.20-11.4.20-21.4.21-1 |
None known |
m4Debian:13 |
All versions, plus listed versions 1.4.19-81.4.20-11.4.20-21.4.21-1 |
None known |
m4Debian:14 |
All versions, plus listed versions 1.4.19-81.4.20-11.4.20-21.4.21-1 |
None known |
m4Root:Debian:12 |
before 1.4.19-3.root.io.2 | 1.4.19-3.root.io.21.4.19-3.root.io.31.4.19-3.root.io.41.4.19-3.aikido.5 |
rootio-m4Root:Debian:12 |
before 1.4.19-3.root.io.2 | 1.4.19-3.root.io.21.4.19-3.root.io.31.4.19-3.root.io.41.4.19-3.aikido.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
vupen.com/english/advisories/2008/1151/references
securityfocus.com/bid/28688
openwall.com/lists/oss-security/2008/04/07/12
exchange.xforce.ibmcloud.com/vulnerabilities/41706
secunia.com/advisories/29671
Show 7 moreShow less
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612
nvd.nist.gov/vuln/detail/CVE-2008-1687
github.com/advisories/GHSA-r86c-jfhj-2f8j
security-tracker.debian.org/tracker/CVE-2008-1687