[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <87lihjscfo.fsf@gnu.org>
Date: Mon, 13 Aug 2012 11:22:51 +0800
From: Chong Yidong <cyd@....org>
To: oss-security@...ts.openwall.com
Subject: Security flaw in GNU Emacs file-local variables
Paul Ling has found a security flaw in the file-local variables code in
GNU Emacs. We are preparing a new Emacs release to address this flaw,
and would like to request a CVE.
When the Emacs user option `enable-local-variables' is set to `:safe'
(the default value is t), Emacs should automatically refuse to evaluate
`eval' forms in file-local variable sections. Due to the bug, Emacs
instead automatically evaluates such `eval' forms. Thus, if the user
changes the value of `enable-local-variables' to `:safe', visiting a
malicious file can cause automatic execution of arbitrary Emacs Lisp
code with the permissions of the user.
The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.
Attached are patches to fix this bug for Emacs 23.4 and Emacs 24.1,
written by Glenn Morris. (The 23.4 patch should apply to the rest of
the Emacs 23.x series.)
Bug tracker ref: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
View attachment "local-vars-patch-23.4.patch" of type "text/x-diff" (1373 bytes)
View attachment "local-vars-patch-24.1.patch" of type "text/x-diff" (1374 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
