Bugzilla Bug 81098

===========================================================
Ubuntu Security Notice USN-76-1           February 07, 2005
emacs21 vulnerability
CAN-2005-0100
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

emacs21-bin-common

The problem can be corrected by upgrading the affected package to
version 21.3+1-5ubuntu4.2. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could have been
exploited to execute arbitrary code with the privileges of the user
and the "mail" group (since "movemail" is installed as "setgid mail").


Reproducible: Didn't try
Steps to Reproduce:

Thanks Marco for finding that it is now public.

*** This bug has been marked as a duplicate of 79686 ***