oss-security - Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / community lists wiki CVSweb mirrors signatures
bringing security into open environments

This website is powered by Openwall GNU/*/Linux security-enhanced OS

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Mon, 12 May 2008 14:10:55 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Emacs 21 fast-lock-mode arbitrary
 lips code execution

======================================================
Name: CVE-2008-2142
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2142
Reference: MISC:http://thread.gmane.org/gmane.emacs.devel/96903
Reference: MISC:http://tracker.xemacs.org/XEmacs/its/issue378
Reference: CONFIRM:https://bugs.gentoo.org/show_bug.cgi?id=221197

Emacs 21 and XEmacs automatically load and execute .flc (fast lock) files
that are associated with other files are edited within Emacs, which allows
user-assisted attackers to execute arbitrary code.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.