GNU bug report logs - #37656
27.0.50; Arbitrary code execution with special `mode:'

Previous Next

Package: emacs;

Reported by: adam plaice <plaice.adam+lists <at> gmail.com>

Date: Tue, 8 Oct 2019 08:49:02 UTC

Severity: normal

Tags: security

Found in version 27.0.50

Fixed in version 30.1

Done: Stefan Kangas <stefankangas <at> gmail.com>

Bug is archived. No further changes may be made.

Full log


Message #20 received at 37656 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Kangas <stefan <at> marxist.se>
To: adam plaice <plaice.adam+lists <at> gmail.com>
Cc: 37656 <at> debbugs.gnu.org, Emacs developers <emacs-devel <at> gnu.org>
Subject: Re: bug#37656: 27.0.50; Arbitrary code execution with special `mode:'
Date: Wed, 16 Oct 2019 00:55:08 +0200
[Message part 1 (text/plain, inline)]
Stefan Kangas <stefan <at> marxist.se> writes:
> The below patch seems to fix it by disabling the feature it exploits.

Here is a more complete patch.  Does it look like the right fix?

I think the relevant node in the documentation is:
(info "(emacs)Choosing Modes")

Best regards,
Stefan Kangas
[0001-Remove-support-for-more-than-one-mode-in-file-local-.patch (application/octet-stream, attachment)]

This bug report was last modified 126 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.