Date: Mon, 13 Aug 2012 11:22:51 +0800 From: Chong Yidong <cyd@....org> To: oss-security@...ts.openwall.com Subject: Security flaw in GNU Emacs file-local variables Paul Ling has found a security flaw in the file-local variables code in GNU Emacs. We are preparing a new Emacs release to address this flaw, and would like to request a CVE. When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user. The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1. Attached are patches to fix this bug for Emacs 23.4 and Emacs 24.1, written by Glenn Morris. (The 23.4 patch should apply to the rest of the Emacs 23.x series.) Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155 View attachment "local-vars-patch-23.4.patch" of type "text/x-diff" (1373 bytes) View attachment "local-vars-patch-24.1.patch" of type "text/x-diff" (1374 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.