Bug 197958 - app-editors/emacs hack-local-variables Security bypass (CVE-2007-5795)
|
Bug#:
197958
(CVE-2007-5795)
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: minor
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: rbu@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449008
|
|
Summary: app-editors/emacs hack-local-variables Security bypass (CVE-2007-5795)
|
|
Keywords:
|
|
Status Whiteboard: B3 [glsa]
|
|
Opened: 2007-11-03 13:44 0000
|
CVE-2007-5795 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5795):
The hack-local-variables function in Emacs before 22.2, when
enable-local-variables is set to :safe, does not properly search lists of
unsafe or risky variables, which might allow user-assisted attackers to
bypass intended restrictions and modify critical program variables via a file
containing a Local variables declaration.
Emacs, please advise.
Is any of our ebuilds affected, or maybe other packages than app-editors/emacs?
Fixed in emacs-22.1-r2. Decreasing severity to B4 since the issue doesn't
affect the default configuration.
Vulnerable versions: <22.1-r2
Unaffected versions: >=22.1-r2, <22
Arch teams: Please stabilise app-editors/emacs-22.1-r2.
amd64 done(committed by wolf31o2 for me)
You'll probably want to back-port this to the latest SLOT=21 version, too.
Vulnerable revision emacs-22.1-r1 removed.
(In reply to comment #8)
> You'll probably want to back-port this to the latest SLOT=21 version, too.
Emacs 21 is not affected; the relevant code is new in version 22.
Setting to B3 and voting
YES
This vulnerability, if emacs is configured as described above, allows execution
of arbitrary LISP (not shell) code, therefore can overwrite files writable by
emacs. See last comment on the Debian report in URL.
