{"id":"CVE-2008-1687","aliases":["DEBIAN-CVE-2008-1687","EUVD-2008-1688","GHSA-r86c-jfhj-2f8j","ROOT-OS-DEBIAN-12-CVE-2008-1687"],"status":"published","title":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0245,"percentile":0.84495,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2008-04-09T19:00:00Z","modified":"2026-10-23T17:47:49Z","fixes":[{"ecosystem":"Root:Debian:12","package":"m4","fixed_in":["1.4.19-3.root.io.2","1.4.19-3.root.io.3","1.4.19-3.root.io.4","1.4.19-3.aikido.5"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-m4","fixed_in":["1.4.19-3.root.io.2","1.4.19-3.root.io.3","1.4.19-3.root.io.4","1.4.19-3.aikido.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"m4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.19-3","1.4.19-4","1.4.19-4+hurd.1","1.4.19-5","1.4.19-6","1.4.19-7","1.4.19-8","1.4.20-1","1.4.20-2","1.4.21-1"]},{"source":"osv","ecosystem":"Debian:13","package":"m4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.19-8","1.4.20-1","1.4.20-2","1.4.21-1"]},{"source":"osv","ecosystem":"Debian:14","package":"m4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.19-8","1.4.20-1","1.4.20-2","1.4.21-1"]},{"source":"osv","ecosystem":"Root:Debian:12","package":"m4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.19-3.root.io.2"},{"fixed":"1.4.19-3.root.io.3"},{"fixed":"1.4.19-3.root.io.4"},{"fixed":"1.4.19-3.aikido.5"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-m4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.19-3.root.io.2"},{"fixed":"1.4.19-3.root.io.3"},{"fixed":"1.4.19-3.root.io.4"},{"fixed":"1.4.19-3.aikido.5"}]}]}],"products":[{"vendor":"gnu","product":"m4"}],"references":[{"url":"http://www.vupen.com/english/advisories/2008/1151/references","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/28688","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2008/04/07/12","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41706","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://secunia.com/advisories/29671","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2008/04/07/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2008/04/07/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/29729","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2008/04/07/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2008\u0026m=slackware-security.510612","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1687"},{"url":"https://github.com/advisories/GHSA-r86c-jfhj-2f8j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-1687","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2008-1687","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2008-04-09T19:00:00Z","modified":"2024-08-07T08:32:01.011Z","updated_at":"2026-11-02T14:34:48.103804Z"}],"euvd":[{"id":"EUVD-2008-1688","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2008-04-09T19:00:00Z","modified":"2024-08-07T08:32:01Z","updated_at":"2026-11-03T01:39:00.729717Z"}],"ghsa":[{"id":"GHSA-r86c-jfhj-2f8j","title":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their...","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2022-05-01T23:42:27Z","modified":"2023-01-31T05:05:50Z","updated_at":"2026-11-02T14:48:55.758723Z"}],"nvd":[{"id":"CVE-2008-1687","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2008-04-09T19:05:00Z","modified":"2026-06-16T22:52:16.267Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:25.857543Z"}],"osv":[{"id":"CVE-2008-1687","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2008-04-09T19:05:00Z","modified":"2026-04-10T03:39:47.771836Z","updated_at":"2026-11-02T15:43:57.178433Z"},{"id":"DEBIAN-CVE-2008-1687","description":"The (1) maketemp and (2) mkstemp builtin functions in GNU m4 before 1.4.11 do not quote their output when a file is created, which might allow context-dependent attackers to trigger a macro expansion, leading to unspecified use of an incorrect filename.","status":"published","published":"2008-04-09T19:05:00Z","modified":"2026-10-23T17:47:49.370651752Z","updated_at":"2026-11-02T15:45:23.742363Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2008-1687","title":"CVE-2008-1687 in m4 - Patched by Root","description":"Root has patched CVE-2008-1687 in the m4 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:08:53Z","modified":"2026-08-26T01:12:54.040997976Z","updated_at":"2026-11-02T15:53:30.44348Z"}]}}