Bug 934736 – <app-editors/emacs-{26.3-r19,27.2-r17,28.2-r13,29.3-r3} <app-emacs/org-mode-9.7.5: org-mode command execution vulnerability

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2024-06-22 16:43:50 UTC]

https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=c645e1d8205f0f0663ec4a2d27575b238c646c7c

Fixed in just-released 29.4.

[Comment 1 Larry the Git Cow 2024-06-22 19:11:21 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1517a3daa51dfa707d64365fb681e15ae7c90a1d

commit 1517a3daa51dfa707d64365fb681e15ae7c90a1d
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2024-06-22 19:02:41 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2024-06-22 19:10:41 +0000

    app-editors/emacs: Backport org-mode fix from Emacs 29.4
    
    Bug: https://bugs.gentoo.org/934736
    Signed-off-by: Ulrich Müller <[e-mail]>

 app-editors/emacs/Manifest              |   3 +
 app-editors/emacs/emacs-26.3-r19.ebuild | 382 ++++++++++++++++++++++
 app-editors/emacs/emacs-27.2-r17.ebuild | 449 ++++++++++++++++++++++++++
 app-editors/emacs/emacs-28.2-r13.ebuild | 544 ++++++++++++++++++++++++++++++++
 4 files changed, 1378 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=1da683c58980d2309322d6e4a6a8dc4791dca923

commit 1da683c58980d2309322d6e4a6a8dc4791dca923
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2024-06-22 17:57:48 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2024-06-22 19:10:39 +0000

    app-editors/emacs: add 29.4
    
    Bug: https://bugs.gentoo.org/934736
    Signed-off-by: Ulrich Müller <[e-mail]>

 app-editors/emacs/Manifest          |   2 +
 app-editors/emacs/emacs-29.4.ebuild | 631 ++++++++++++++++++++++++++++++++++++
 2 files changed, 633 insertions(+)

[Comment 2 Larry the Git Cow 2024-06-23 10:14:13 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4554e0e224b1a967661ebb5b63b1d35b544617c5

commit 4554e0e224b1a967661ebb5b63b1d35b544617c5
Author:     Ulrich Müller <[e-mail]>
AuthorDate: 2024-06-23 10:09:36 +0000
Commit:     Ulrich Müller <[e-mail]>
CommitDate: 2024-06-23 10:13:15 +0000

    app-editors/emacs: Backport org-mode fix from Emacs 29.4
    
    Bug: https://bugs.gentoo.org/934736
    Signed-off-by: Ulrich Müller <[e-mail]>

 app-editors/emacs/Manifest             |   1 +
 app-editors/emacs/emacs-29.3-r3.ebuild | 631 +++++++++++++++++++++++++++++++++
 2 files changed, 632 insertions(+)

[Comment 3 Ulrich Müller 2024-06-29 20:11:20 UTC]

*** Bug 934738 has been marked as a duplicate of this bug. ***

[Comment 4 Ulrich Müller 2024-06-29 20:12:30 UTC]

*** Bug 934741 has been marked as a duplicate of this bug. ***

[Comment 5 John Helmert III 2024-09-22 02:23:41 UTC]

Doing a GLSA since the remaining arch stabilizations aren't primaries.

[Comment 6 Larry the Git Cow 2024-09-22 09:04:24 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=c5244efc38e02f2f0af5af93f3b49a15bf368da2

commit c5244efc38e02f2f0af5af93f3b49a15bf368da2
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2024-09-22 09:04:08 +0000
Commit:     Hans de Graaff <[e-mail]>
CommitDate: 2024-09-22 09:04:22 +0000

    [ GLSA 202409-19 ] Emacs, org-mode: Command Execution Vulnerability
    
    Bug: https://bugs.gentoo.org/934736
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Hans de Graaff <[e-mail]>

 glsa-202409-19.xml | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)