Gentoo Linux Security Advisory 201403-5 - Two vulnerabilities have been found in GNU Emacs, possibly leading to user-assisted execution of arbitrary code. Versions less than 24.1-r1 are affected.
fcc71b90de871eaffab6688a5962d6a9a3a70a8af03b82173b7f3b5e9b07ba7fMandriva Linux Security Advisory 2013-076 - Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file. lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file. Additionally a problem was fixed reading xz compressed files.
28aa6e68e7e28f1880a09b97dd7e6c76ad436e9eeee65f8ad82676881c69c8b8Debian Linux Security Advisory 2603-1 - Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to "safe".
ddf7bc7c4889ddfe1ef2ad9bd0556f0b667bb36217ab5501a99f4c11108e2209Debian Linux Security Advisory 2603-1 - Paul Ling discovered that Emacs insufficiently restricted the evaluation of Lisp code if enable-local-variables is set to "safe".
ddf7bc7c4889ddfe1ef2ad9bd0556f0b667bb36217ab5501a99f4c11108e2209Ubuntu Security Notice 1586-1 - Hiroshi Oota discovered that Emacs incorrectly handled search paths. If a user were tricked into opening a file with Emacs, a local attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. Paul Ling discovered that Emacs incorrectly handled certain eval forms in local-variable sections. If a user were tricked into opening a specially crafted file with Emacs, a remote attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. Various other issues were also addressed.
e68c5c5c496cdf07a56ecb2cebeb00389e61b3d59a69baac3725b58811acc749Slackware Security Advisory - New emacs packages are available for Slackware 13.1, 13.37, and -current to fix a security issue.
8a757d6bea44c9dd035d0408752f3bb928eacfee019caeb16488cc712eb2fc93
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed