Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 13 Aug 2012 11:22:51 +0800
From: Chong Yidong <>
Subject: Security flaw in GNU Emacs file-local variables

Paul Ling has found a security flaw in the file-local variables code in
GNU Emacs.  We are preparing a new Emacs release to address this flaw,
and would like to request a CVE.

When the Emacs user option `enable-local-variables' is set to `:safe'
(the default value is t), Emacs should automatically refuse to evaluate
`eval' forms in file-local variable sections.  Due to the bug, Emacs
instead automatically evaluates such `eval' forms.  Thus, if the user
changes the value of `enable-local-variables' to `:safe', visiting a
malicious file can cause automatic execution of arbitrary Emacs Lisp
code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.

Attached are patches to fix this bug for Emacs 23.4 and Emacs 24.1,
written by Glenn Morris.  (The 23.4 patch should apply to the rest of
the Emacs 23.x series.)

Bug tracker ref:

View attachment "local-vars-patch-23.4.patch" of type "text/x-diff" (1373 bytes)

View attachment "local-vars-patch-24.1.patch" of type "text/x-diff" (1374 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.