CVE-2014-9483

A command injection vulnerability was discovered in the Emacs text editor. A remote, unauthenticated attacker can exploit it to execute arbitrary shell commands on a vulnerable system. The attack is triggered by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.

The read-passwd and other Lisp functions in Emacs 20 do not properly clear the history of recently typed keys, allowing an attacker to read unencrypted passwords.

Emacs 20 does not properly set permissions for a slave PTY device when starting a new subprocess, which allows local users to read or modify communications between Emacs and the subprocess.

The make-temp-name function in Emacs 20 creates temporary files with predictable names, allowing attackers to conduct a symlink attack.