GNU bug report logs - #28350
CVE-2017-14482: enriched.el code execution

Previous Next

Full log

Message #48 received at 28350 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: "Charles A. Roelli" <charles <at> aurox.ch>
Cc: larsi <at> gnus.org, 28350 <at> debbugs.gnu.org
Subject: Re: enriched.el code execution
Date: Sun, 10 Sep 2017 14:46:59 -0700

Charles A. Roelli wrote:

> Do we know that "x-color" and/or "x-bg-color" are vulnerable to a
> similar misuse as "x-display"?  If not, I can still re-add them at a
> later time.

Eli asked the same question privately. I don't know the code myself; perhaps 
Lars could say.

>> +  (provide 'enriched)
>> +  (defun enriched-mode (&optional arg))
>> +  (defun enriched-decode (from to))
> 
> This fix is very safe, at the cost of disabling Enriched mode.  Could
> we do any better?  I had suggested the following (in
> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350#16):
> 
>    (eval-after-load "enriched"
>      '(defun enriched-decode-display-prop (start end &optional param)
>         (list start end)))
> 
> But it may not work in Emacs earlier than 23 (I can't test it).

It should work, since eval-after-load predates Emacs 19.29.  Though it assumes 
that x-display is the only problem here.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.