Subject: [Kurt Seifried] Re: [oss-security] Security flaw in GNU Emacs file-local variables

From: Chong Yidong <[email-masked]>
Date: Tue, 14 Aug 2012 11:16:50 +0800

Subject: Re: [oss-security] Security flaw in GNU Emacs file-local variables
From: Kurt Seifried <[email-masked]>
To: [email-masked]
Cc: Chong Yidong <[email-masked]>
Date: Sun, 12 Aug 2012 23:42:36 -0600

On 08/12/2012 09:22 PM, Chong Yidong wrote:
> Paul Ling has found a security flaw in the file-local variables
> code in GNU Emacs.  We are preparing a new Emacs release to address
> this flaw, and would like to request a CVE.
> 
> When the Emacs user option `enable-local-variables' is set to
> `:safe' (the default value is t), Emacs should automatically refuse
> to evaluate `eval' forms in file-local variable sections.  Due to
> the bug, Emacs instead automatically evaluates such `eval' forms.
> Thus, if the user changes the value of `enable-local-variables' to
> `:safe', visiting a malicious file can cause automatic execution of
> arbitrary Emacs Lisp code with the permissions of the user.
> 
> The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.
> 
> Attached are patches to fix this bug for Emacs 23.4 and Emacs
> 24.1, written by Glenn Morris.  (The 23.4 patch should apply to the
> rest of the Emacs 23.x series.)
> 
> Bug tracker ref:
> http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155

Please use CVE-2012-3479 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993