|
|
| |
|
| |
emacs: code execution
| Package(s): | emacs |
CVE #(s): | CVE-2012-3479
|
| Created: | August 16, 2012 |
Updated: | January 10, 2013 |
| Description: |
From the Slackware advisory:
Patched to fix a security flaw in the file-local variables code.
When the Emacs user option `enable-local-variables' is set to `:safe'
(the default value is t), Emacs should automatically refuse to evaluate
`eval' forms in file-local variable sections. Due to the bug, Emacs
instead automatically evaluates such `eval' forms. Thus, if the user
changes the value of `enable-local-variables' to `:safe', visiting a
malicious file can cause automatic execution of arbitrary Emacs Lisp
code with the permissions of the user. Bug discovered by Paul Ling. |
| Alerts: |
|
( Log in to post comments)
|
|
|