CVE-2008-1687
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...
CVE-2008-1687 is a high vulnerability (CVSS 7.5) in Gnu M4, published April 9, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in m4 1.4.19-3.root.io.2.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 2.45%EPSS, 84th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.4.19-3.root.io.2m4 +4 more
Description
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
m4Debian:12 | All versions, plus listed versions 1.4.19-31.4.19-41.4.19-4+hurd.11.4.19-51.4.19-6 Show 5 moreShow less1.4.19-71.4.19-81.4.20-11.4.20-21.4.21-1 | None known |
m4Debian:13 | All versions, plus listed versions 1.4.19-81.4.20-11.4.20-21.4.21-1 | None known |
m4Debian:14 | All versions, plus listed versions 1.4.19-81.4.20-11.4.20-21.4.21-1 | None known |
m4Root:Debian:12 | before 1.4.19-3.root.io.2 | 1.4.19-3.root.io.21.4.19-3.root.io.31.4.19-3.root.io.41.4.19-3.aikido.5 |
rootio-m4Root:Debian:12 | before 1.4.19-3.root.io.2 | 1.4.19-3.root.io.21.4.19-3.root.io.31.4.19-3.root.io.41.4.19-3.aikido.5 |
What each source reports
NVD Score used
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- Updated
- 2026-11-02
EUVDEUVD-2008-1688No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
EUVD-2008-1688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r86c-jfhj-2f8jNo score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
GHSA-r86c-jfhj-2f8j- Updated
- 2026-11-02
OSVNo score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
CVE-2008-1687- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-1687No score
The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.
- Record
DEBIAN-CVE-2008-1687- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2008-1687No score
CVE-2008-1687 in m4 - Patched by Root
Root has patched CVE-2008-1687 in the m4 package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2008-1687- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2008/1151/references
securityfocus.com/bid/28688
openwall.com/lists/oss-security/2008/04/07/12
exchange.xforce.ibmcloud.com/vulnerabilities/41706
secunia.com/advisories/29671
Show 7 moreShow less
slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.510612
nvd.nist.gov/vuln/detail/CVE-2008-1687
github.com/advisories/GHSA-r86c-jfhj-2f8j
security-tracker.debian.org/tracker/CVE-2008-1687