CVE-2012-3479
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local...
CVE-2012-3479 is a medium vulnerability (CVSS 6.8) in Gnu Emacs, published August 25, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.74%, the 89th percentile. Fixed in emacs23 23.2+1-7+squeeze1.
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
Exploit likelihood
What each source reports
NVD Score used
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
- Record
CVE-2012-3479- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
- Record
CVE-2012-3479- Updated
- 2026-11-02
EUVDEUVD-2012-3435 No score
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
- Record
EUVD-2012-3435- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fh9m-xg7x-wmp2 No score
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local...
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
- Record
GHSA-fh9m-xg7x-wmp2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
emacs23Debian:6.0 |
before 23.2+1-7+squeeze1, plus listed versions 23.2+1-7 |
23.2+1-7+squeeze1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
slackware.com/security/viewer.php?l=slackware-security&y=2012&m=slackware-security.420006
debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
lists.opensuse.org/opensuse-updates/2012-10/msg00057.html
secunia.com/advisories/50801
openwall.com/lists/oss-security/2012/08/13/2
ubuntu.com/usn/USN-1586-1