Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
99
security advisorycriticalremote code executionSlackware 10.1 Critical: Emacs Movemail Remote Code Execution Advisory
New emacs packages are available for Slackware 10.1 and -current to a security issue with the movemail utility for retrieving mail from a POP mail server. If used to connect to a malicious POP server, it is possible for the server to cause the execution of arbitrary code as . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] emacs movemail POP utility (SSA:2005-201-02) New emacs packages are available for Slackware 10.1 and -current to a security issue with the movemail utility for retrieving mail from a POP mail server. If used to connect to a malicious POP server, it is possible for the server to cause the execution of arbitrary code as the user running emacs. Here are the details from the Slackware 10.1 ChangeLog: +--------------------------+ patches/packages/emacs-21.4a-i486-1.tgz: Upgraded to emacs-21.4a. This fixes a vulnerability in the movemail utility when connecting to a malicious POP server that may allow the execution of arbitrary code as the user running emacs. (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Updated packages for Slackware 10.1: ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-21.4a-i486-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-info-21.4a-noarch-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-leim-21.4-noarch-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-lisp-21.4a-noarch-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-misc-21.4a-noarch-1.tgz ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-nox-21.4a-i486-1.tgz Updated packages for Slackware -current: MD5 signatures: +-------------+ Slackware 10.1 packages: 7bb30482651e5e4558eea0b66b55d1de emacs-21.4a-i486-1.tgz 45b0fb651c6c7b9deacb55efe582b4b5 emacs-info-21.4a-noarch-1.tgz 5d0152fa95027215b14ece0f8fbf8a37 emacs-leim-21.4-noarch-1.tgz 5bd976633a33dad36161eba7e92bec61 emacs-lisp-21.4a-noarch-1.tgz 2763fe68ed8c833ed95ec4c95aacc562 emacs-misc-21.4a-noarch-1.tgz 195df428e1a10c50da88129002c9e2f9 emacs-nox-21.4a-i486-1.tgz Slackware -current packages: 44986e6ca1e02d971f43e3d0f118dde3 emacs-21.4a-i486-1.tgz 100643203d73d54df78c58eef8596e4b emacs-info-21.4a-noarch-1.tgz 70effd3b113d795d8532022139269f77 emacs-leim-21.4-noarch-1.tgz 2bcec4297285f30124e2a61f85a27440 emacs-lisp-21.4a-noarch-1.tgz 48ebc0d4e581d5deb15159a4d34c060d emacs-misc-21.4a-noarch-1.tgz 04fb5ed4b1da572063b2a991d8c54edf emacs-nox-21.4a-i486-1.tgz Installation instructions: +------------------------+ Upgrade the packages as root: # upgradepkg emacs-21.4a-i486-1.tgz emacs-info-21.4a-noarch-1.tgz emacs-leim-21.4-noarch-1.tgz emacs-lisp-21.4a-noarch-1.tgz emacs-misc-21.4a-noarch-1.tgz emacs-nox-21.4a-i486-1.tgz +-----+ . Recent updates to Emacs plugins tackle a significant vulnerability found in Slackware's movemail component of the POP utility, which could allow for remote code execution.. Slackware Security, Emacs Security, Movemail Update, Critical Vulnerability. . Severity: Critical. LinuxSecurity.com Team
Jul 20, 2005
•Critical
Slackware
91
security advisorygentooformat stringGentoo: 200502-20 Normal: Emacs Movemail Format String Vulnerabilities
The movemail utility shipped with Emacs and XEmacs contains several format string vulnerabilities, potentially leading to the execution of arbitrary code. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200502-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Emacs, XEmacs: Format string vulnerabilities in movemail Date: February 15, 2005 Bugs: #79686 ID: 200502-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= The movemail utility shipped with Emacs and XEmacs contains several format string vulnerabilities, potentially leading to the execution of arbitrary code. Background ========= GNU Emacs and XEmacs are highly extensible and customizable text editors. movemail is an Emacs utility that can fetch mail on remote mail servers. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-editors/emacs < 21.4 > = 21.4 2 app-editors/xemacs < 21.4.15-r3 > = 21.4.15-r3 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description ========== Max Vozeler discovered that the movemail utility contains several format string errors. Impact ===== An attacker could set up a malicious POP server and entice a user to connect to it using movemail, resulting in the execution of arbitrary code with the rights of the victim user. Workaround ========= There isno known workaround at this time. Resolution ========= All Emacs users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-editors/emacs-21.4" All XEmacs users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =app-editors/xemacs-21.4.15-r3" References ========= [ 1 ] CAN-2005-0100 https://www.cve.org/CVERecord?id=CVE-CAN-2005-0100 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200502-20 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Feb 15, 2005
Gentoo
89
security advisoryfedora corestring formatFedora Core 3: 2005-147 Medium: Xemacs Movemail Format Issue
Update to 21.4.17 stable release, which also fixes the CAN-2005-0100 movemail string format vulnerability and the AltGr issue for European input.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-146 2005-02-14 ---------------------------------------------------------------------Product : Fedora Core 3 Name : xemacs Version : 21.4.17 Release : 0.FC3 Summary : A different version of Emacs. Description : XEmacs is a highly customizable open source text editor and application development system. It is protected under the GNU Public License and related to other versions of Emacs, in particular GNU Emacs. Its emphasis is on modern graphical user interface support and an open software development model, similar to Linux. This package contains xemacs built for X Windows with MULE support. ---------------------------------------------------------------------Update Information: Update to 21.4.17 stable release, which also fixes the CAN-2005-0100 movemail string format vulnerability and the AltGr issue for European input. ---------------------------------------------------------------------* Mon Feb 7 2005 Jens Petersen - 21.4.17-1 - update to 21.4.17 - fixes movemail format string vulnerability (CAN-2005-0100, 146705) - xemacs-21.4.16-xutil-keysym-144601.patch no longer needed * Tue Jan 25 2005 Jens Petersen - 21.4.16-2 - workaround xorg-x11 issue with iso-level3-shift (Ville Skyttä, 144601) * Mon Dec 13 2004 Jens Petersen - 21.4.16-1 - update to new stable release - no longer need configure-ppc-ldscript.patch and xemacs-21.4.15-pui-120437.patch - default to unified diff in .xemacs/init.el * Thu Nov 18 2004 Jens Petersen - 21.4.15-10 - show xemacs again in the desktop menu (132567) ---------------------------------------------------------------------This update can be downloaded from: 0643ce40c75e63bd0c3517b0fd37dd8e SRPMS/xemacs-21.4.17-0.FC3.src.rpm c22ed89c0629b8032d2c15019e3df91c x86_64/xemacs-21.4.17-0.FC3.x86_64.rpm 3f9d4f981e55ba4a34f1a462b7b045c0 x86_64/xemacs-common-21.4.17-0.FC3.x86_64.rpm 7473de9e737937b8a959edc6605c6b2d x86_64/xemacs-nox-21.4.17-0.FC3.x86_64.rpm d203f83f9cb7c3a9ef9e50e047fdb899 x86_64/xemacs-el-21.4.17-0.FC3.x86_64.rpm d103de529ad9e9c349dd4e15328a8a76 x86_64/xemacs-info-21.4.17-0.FC3.x86_64.rpm be715c074a3d8b07ec012db026eb7d99 x86_64/debug/xemacs-debuginfo-21.4.17-0.FC3.x86_64.rpm f61b8ed753232bc0bcba0393d3fb90fb i386/xemacs-21.4.17-0.FC3.i386.rpm dd33128ed8cf0862f19c0640c9c5fa84 i386/xemacs-common-21.4.17-0.FC3.i386.rpm c3d709f47ea784b06fb2d732ee9fb34e i386/xemacs-nox-21.4.17-0.FC3.i386.rpm ab6db513be70fa76a9cccd463f889c53 i386/xemacs-el-21.4.17-0.FC3.i386.rpm 58fc1b5ef9e53620b8eb8950e8e0cabe i386/xemacs-info-21.4.17-0.FC3.i386.rpm 7f2c7dda2f84409df7c48d1912215fd8 i386/debug/xemacs-debuginfo-21.4.17-0.FC3.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. -----------------------------------------------------------------------fedora-announce-list mailing list
Feb 15, 2005
•Medium
Fedora
89
security advisorymoderatefedoraFedora: FEDORA-2005-145 Moderate: XEmacs Movemail Format Issue
Update to 21.4.17 stable release, which also fixes the CAN-2005-0100 movemail string format vulnerability.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-145 2005-02-14 ---------------------------------------------------------------------Product : Fedora Core 2 Name : xemacs Version : 21.4.17 Release : 0.FC2 Summary : A different version of Emacs. Description : XEmacs is a highly customizable open source text editor and application development system. It is protected under the GNU Public License and related to other versions of Emacs, in particular GNU Emacs. Its emphasis is on modern graphical user interface support and an open software development model, similar to Linux. This package contains xemacs built for X Windows with MULE support. ---------------------------------------------------------------------Update Information: Update to 21.4.17 stable release, which also fixes the CAN-2005-0100 movemail string format vulnerability. ---------------------------------------------------------------------* Mon Feb 7 2005 Jens Petersen - update to 21.4.17 - fixes movemail format string vulnerability (CAN-2005-0100, 146705) - xemacs-21.4.16-xutil-keysym-144601.patch no longer needed * Tue Jan 25 2005 Jens Petersen - 21.4.16-2 - workaround xorg-x11 issue with iso-level3-shift (Ville Skyttä, 144601) * Mon Dec 13 2004 Jens Petersen - 21.4.16-1 - update to new stable release - no longer need configure-ppc-ldscript.patch and xemacs-21.4.15-pui-120437.patch - default to unified diff in .xemacs/init.el * Thu Nov 18 2004 Jens Petersen - 21.4.15-10 - show xemacs again in the desktop menu (132567) * Mon Oct 18 2004 Jens Petersen - 21.4.15-9 - fix etag alternatives removal when uninstalling (Karsten Hopp, 136137) * Wed Oct 6 2004 Jens Petersen - xemacs-el no longer requires xemacs for -nox users (Lars Hupfeldt Nielsen, 134479) * Thu Sep 302004 Jens Petersen - 21.4.15-8 - cleanup and update .desktop file - make xemacs not appear in the desktop menu (Seth Nickell,132567) - move the desktop file from -common to main package - etags is now handled by alternatives (92256) - no longer require ctags - turn back on wnn support and add xemacs-21.4.15-wnnfix-128362.patch (Yukihiro Nakai, 128362) * Tue Jun 15 2004 Elliot Lee - rebuilt * Mon Jun 7 2004 Jens Petersen - 21.4.15-6 - don't link with -export-dynamic on ia64 to stop dumped function pointers from breaking (Roland McGrath & Jakub Jelinek, #106744) - disable dynamic module support on ia64 - change the xemacs-info uninstall script from %postun to %preun and move the post/preun install-info requires to xemacs-info - simplify coding-system setup somewhat in site-start.el - fix up the desktop file (Ville Skyttä, 123135) - xemacs-nox now requires xemacs-sumo - build without xfs since it seems to cause some problem with fonts missing * Wed May 5 2004 Jens Petersen - move install-info requirement to xemacs-info - drop unnecessary Canna-libs requirement ---------------------------------------------------------------------This update can be downloaded from: d97d1380dba413cbddedda2fa141394a SRPMS/xemacs-21.4.17-0.FC2.src.rpm 303906a89774a0bd34d84354859264c6 x86_64/xemacs-21.4.17-0.FC2.x86_64.rpm 104f72f402d2e83af7a6c067c9d37333 x86_64/xemacs-common-21.4.17-0.FC2.x86_64.rpm 0c90a50234004203cfe7e97c3d08ca8d x86_64/xemacs-nox-21.4.17-0.FC2.x86_64.rpm 07f12cb446ffa6c92aada9b2a3411680 x86_64/xemacs-el-21.4.17-0.FC2.x86_64.rpm 9cd30580fc3b572a0bd7defe19d3fa6b x86_64/xemacs-info-21.4.17-0.FC2.x86_64.rpm 18a67f26082b215599a07f2818bd434a x86_64/debug/xemacs-debuginfo-21.4.17-0.FC2.x86_64.rpm 3c01ec4518483f5c39e1fefb7a896d60 i386/xemacs-21.4.17-0.FC2.i386.rpm e640edccfe9d85c6d78b73ab00843662 i386/xemacs-common-21.4.17-0.FC2.i386.rpm bbbef68286645419681a3e5625532d29 i386/xemacs-nox-21.4.17-0.FC2.i386.rpm 68f22b910cefcc42bc020e3331721661 i386/xemacs-el-21.4.17-0.FC2.i386.rpm 2a3bb0839ad8c3a0c173b5791cba6b8d i386/xemacs-info-21.4.17-0.FC2.i386.rpm 69fef3ec6d429bc548a2c602b0a919be i386/debug/xemacs-debuginfo-21.4.17-0.FC2.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. --------------------------------------------------------------------- --------------enig9404029E17EA88AA57787F95 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE-----Version: GnuPG v1.2.6 (GNU/Linux) Comment: Using GnuPG with Mozilla - iD8DBQFCEX8e8SXyPe8n7dERAiXFAJ9XQFuZ7cNbZKJrlouuqomX5iFdmACfXqQw gu8f/zjzjca00TfoeeUzPNU=IPht -----END PGP SIGNATURE-------------------enig9404029E17EA88AA57787F95-- --===============1329973991=Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --fedora-announce-list mailing list
Feb 15, 2005
Fedora
89
security advisoryFedorabug fixFedora: FEDORA-2005-116 Moderate: Emacs Movemail Vulnerability Fixed
This update fixes the CAN-2005-0100 movemail vulnerability and backports the latest bug fixes.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-116 2005-02-08 ---------------------------------------------------------------------Product : Fedora Core 3 Name : emacs Version : 21.3 Release : 21.FC3 Summary : GNU Emacs text editor Description : Emacs is a powerful, customizable, self-documenting, modeless text editor. Emacs contains special code editing features, a scripting language (elisp), and the capability to read mail, news, and more without leaving the editor. This package provides an emacs binary with support for X windows. ---------------------------------------------------------------------Update Information: This update fixes the CAN-2005-0100 movemail vulnerability and backports the latest bug fixes. ---------------------------------------------------------------------* Fri Feb 04 2005 Jens Petersen - 21.3-21 - fix CAN-2005-0100 movemail vulnerability with movemail-CAN-2005-0100.patch (Max Vozeler, 146702) * Fri Jan 14 2005 Jens Petersen - 21.3-20 - workaround xorg-x11 modifier key problem with emacs-21.3-xterm-modifiers-137868.patch (Thomas Woerner, 137868) * Mon Nov 29 2004 Jens Petersen - 21.3-19 - prefer XIM status under-the-window for now to stop xft httx from dying (125413): add emacs-xim-status-under-window-125413.patch - default diff to unified format in .emacs * Thu Nov 04 2004 Jens Petersen - 21.3-18 - show emacs again in the desktop menu (132567) - require fonts-xorg-75dpi to prevent empty boxes at startup due to missing fonts (Johannes Kaiser, 137060) ---------------------------------------------------------------------This update can be downloaded from: 1ae44786c50272b20eaaa6227867897d SRPMS/emacs-21.3-21.FC3.src.rpm 29763c9c025f26c09cb31368af1807f5 x86_64/emacs-21.3-21.FC3.x86_64.rpm f09ae3756e0bd5d5e9cf645ff0f73896 x86_64/emacs-nox-21.3-21.FC3.x86_64.rpm 43a225a811cfcb76a6a48bebb53560fd x86_64/emacs-common-21.3-21.FC3.x86_64.rpm b2491aff5f03654bceb38825284d2a1a x86_64/emacs-el-21.3-21.FC3.x86_64.rpm 65979686b6004eb4f0d96fd055b42295 x86_64/emacs-leim-21.3-21.FC3.x86_64.rpm 4ef36a839ea60a0b9c5524ba65e0ab2b x86_64/debug/emacs-debuginfo-21.3-21.FC3.x86_64.rpm 2ebd012dfca888624f6041e5569af8bc i386/emacs-21.3-21.FC3.i386.rpm 0db83d1b9b286c7c05b67ec3a5b60cc1 i386/emacs-nox-21.3-21.FC3.i386.rpm bffd4a4dbad9fd3e837bc87551b2a31b i386/emacs-common-21.3-21.FC3.i386.rpm c2b41581645192afe7cf1be6ce5669de i386/emacs-el-21.3-21.FC3.i386.rpm 5598497a282fb25595020f819af848c7 i386/emacs-leim-21.3-21.FC3.i386.rpm caba6d8fd97ba7a7ecf5f71f8f1b7525 i386/debug/emacs-debuginfo-21.3-21.FC3.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. -----------------------------------------------------------------------fedora-announce-list mailing list
Feb 08, 2005
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!