[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZgFOKFCJarJj1N4w@eldamar.lan>
Date: Mon, 25 Mar 2024 11:12:56 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: GNU emacs 29.3 released to fix security issues
Hi,
On Sun, Mar 24, 2024 at 09:05:20AM -0700, Alan Coopersmith wrote:
> https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html reports:
>
> > Version 29.3 of Emacs, the extensible text editor, should now
> > be available from your nearest GNU mirror:
> >
> > https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.xz
> > https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.gz[...]
> > Emacs 29.3 is an emergency bugfix release; it includes no new features
> > except a small number of changes intended to resolve security
> > vulnerabilities uncovered in Emacs 29.2. See the file etc/NEWS in the
> > tarball; you can view it from Emacs by typing 'C-h n', or by clicking
> > Help->Emacs News from the menu bar.
> >
> > You can also browse NEWS on-line using this URL:
> >
> > https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
> >
> > For the complete list of changes and the people who made them, see the
> > various ChangeLog files in the source distribution. For a summary of
> > all the people who have contributed to Emacs, see the etc/AUTHORS
> > file.
> >
> > For more information about Emacs, see:
> > https://www.gnu.org/software/emacs
>
> https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
> lists these changes:
>
> > * Changes in Emacs 29.3
> > Emacs 29.3 is an emergency bugfix release intended to fix several
> > security vulnerabilities described below.
> >
> > ** Arbitrary Lisp code is no longer evaluated as part of turning on Org mode.
> > This is for security reasons, to avoid evaluating malicious Lisp code.
> >
> > ** New buffer-local variable 'untrusted-content'.
> > When this is non-nil, Lisp programs should treat buffer contents with
> > extra caution.
> >
> > ** Gnus now treats inline MIME contents as untrusted.
> > To get back previous insecure behavior, 'untrusted-content' should be
> > reset to nil in the buffer.
> >
> > ** LaTeX preview is now by default disabled for email attachments.
> > To get back previous insecure behavior, set the variable
> > 'org--latex-preview-when-risky' to a non-nil value.
> >
> > ** Org mode now considers contents of remote files to be untrusted.
> > Remote files are recognized by calling 'file-remote-p'.
>
> The detailed changelogs are at:
> https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4?h=emacs-29
Related to this there is as well an org-mode update:
https://list.orgmode.org/87o7b3eczr.fsf@bzg.fr/T/#t
quoting that post:
> I just released Org mode 9.6.23 that fixes several critical
> vulnerabilities. The release is coordinated with emergency Emacs 29.3
> release
> (https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html).
>
> Please upgrade your Org mode *and* Emacs ASAP.
>
> The vulnerabilities involve arbitrary Elisp and LaTeX evaluation when
> previewing attachments in Emacs or when opening third-party Org files.
>
> The arbitrary Elisp evaluation is fixed by this release.
>
> The fix for LaTeX evaluation requires Emacs 29.3 and will not work for
> the earlier Emacs versions. If upgrading Emacs is not viable, as a
> workaround, you can set `org-preview-latex-default-process' to 'verbatim
> - this will disable LaTeX previews and avoid the vulnerability.
I believe CVE assignments are yet missing. RedHat folks, can you
assign CVEs as needed for the individual emacs and org-mode issues?
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
