Slackware 13.37 SSA-2012-228-02 Moderate Emacs Code Execution Threat
slackware
August 16, 2012
New emacs packages are available for Slackware 13.1, 13.37, and -current to fix a security issue
Summary
Here are the details from the Slackware 13.37 ChangeLog: patches/packages/emacs-23.3-i486-2_slack13.37.txz: Rebuilt. Patched to fix a security flaw in the file-local variables code. When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user. Bug discovered by Paul Ling. For more information, see: https://www.cve.org/CVERecord?id=CVE-2012-3479 (* Security fix *)
Topics Covered
Where Find New Packages
Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org/) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for
additional mirror sites near you.
Updated package for Slackware 13.1:
Updated package for Slackware x86_64 13.1:
Updated package for Slackware 13.37:
Updated package for Slackware x86_64 13.37:
Updated package for Slackware -current:
Updated package for Slackware x86_64 -current:
MD5 Signatures
Slackware 13.1 package:
3fc088a80cee2997e5d2a2623c7a6fad emacs-23.2-i486-2_slack13.1.txz
Slackware x86_64 13.1 package:
648a8d3ba5dc27c72db682c6df11f2b9 emacs-23.2-x86_64-2_slack13.1.txz
Slackware 13.37 package:
6a1687460997d6bf783b84d4f0e28bf0 emacs-23.3-i486-2_slack13.37.txz
Slackware x86_64 13.37 package:
e9666c12921b5a2a2a18a6dac4a47cd0 emacs-23.3-x86_64-2_slack13.37.txz
Slackware -current package:
a10860f88686b2e5d162cde4c5a7bd35 e/emacs-24.1-i486-6.txz
Slackware x86_64 -current package:
b2dbf220f1ea9a38538e468a0b576d4c e/emacs-24.1-x86_64-6.txz
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Installation Instructions
Installation instructions: Upgrade the package as root: # upgradepkg emacs-23.3-i486-2_slack13.37.txz
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!