Bug 81098

Summary:	Emacs vulnerability
Product:	Gentoo Security	Reporter:	Marco Morales <soulse>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	normal
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Marco Morales 2005-02-07 04:53:20 UTC

===========================================================
Ubuntu Security Notice USN-76-1           February 07, 2005
emacs21 vulnerability
CAN-2005-0100
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

emacs21-bin-common

The problem can be corrected by upgrading the affected package to
version 21.3+1-5ubuntu4.2. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could have been
exploited to execute arbitrary code with the privileges of the user
and the "mail" group (since "movemail" is installed as "setgid mail").


Reproducible: Didn't try
Steps to Reproduce:

Comment 1 Thierry Carrez (RETIRED) gentoo-dev

2005-02-07 05:03:00 UTC

Thanks Marco for finding that it is now public.

*** This bug has been marked as a duplicate of 79686 ***