Re: GNU emacs 29.3 released to fix security issues

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: GNU emacs 29.3 released to fix security issues

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Salvatore Bonaccorso &lt;carnil () debian org&gt;

Date: Mon, 25 Mar 2024 21:25:58 +0100

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On Mon, Mar 25, 2024 at 11:12:56AM +0100, Salvatore Bonaccorso wrote:
Hi,

On Sun, Mar 24, 2024 at 09:05:20AM -0700, Alan Coopersmith wrote:
https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html reports:

Version 29.3 of Emacs, the extensible text editor, should now
be available from your nearest GNU mirror:

   https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.xz
   https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.gz[...]
Emacs 29.3 is an emergency bugfix release; it includes no new features
except a small number of changes intended to resolve security
vulnerabilities uncovered in Emacs 29.2.  See the file etc/NEWS in the
tarball; you can view it from Emacs by typing 'C-h n', or by clicking
Help-&gt;Emacs News from the menu bar.

You can also browse NEWS on-line using this URL:

  https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29

For the complete list of changes and the people who made them, see the
various ChangeLog files in the source distribution.  For a summary of
all the people who have contributed to Emacs, see the etc/AUTHORS
file.

For more information about Emacs, see:
  https://www.gnu.org/software/emacs

https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
lists these changes:

* Changes in Emacs 29.3
Emacs 29.3 is an emergency bugfix release intended to fix several
security vulnerabilities described below.

** Arbitrary Lisp code is no longer evaluated as part of turning on Org mode.
This is for security reasons, to avoid evaluating malicious Lisp code.

** New buffer-local variable 'untrusted-content'.
When this is non-nil, Lisp programs should treat buffer contents with
extra caution.

** Gnus now treats inline MIME contents as untrusted.
To get back previous insecure behavior, 'untrusted-content' should be
reset to nil in the buffer.

** LaTeX preview is now by default disabled for email attachments.
To get back previous insecure behavior, set the variable
'org--latex-preview-when-risky' to a non-nil value.

** Org mode now considers contents of remote files to be untrusted.
Remote files are recognized by calling 'file-remote-p'.

The detailed changelogs are at:
https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4?h=emacs-29

Related to this there is as well an org-mode update:

https://list.orgmode.org/87o7b3eczr.fsf () bzg fr/T/#t

quoting that post:

I just released Org mode 9.6.23 that fixes several critical
vulnerabilities. The release is coordinated with emergency Emacs 29.3
release
(https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html).

Please upgrade your Org mode *and* Emacs ASAP.

The vulnerabilities involve arbitrary Elisp and LaTeX evaluation when
previewing attachments in Emacs or when opening third-party Org files.

The arbitrary Elisp evaluation is fixed by this release.

The fix for LaTeX evaluation requires Emacs 29.3 and will not work for
the earlier Emacs versions. If upgrading Emacs is not viable, as a
workaround, you can set `org-preview-latex-default-process' to 'verbatim
- this will disable LaTeX previews and avoid the vulnerability.

I believe CVE assignments are yet missing. RedHat folks, can you
assign CVEs as needed for the individual emacs and org-mode issues?

CVEs are now assigned for the emacs and org-mode issues:

CVE-2024-30205:
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&amp;id=2bc865ace050ff118db43f01457f95f95112b877
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=4255d5dcc0657915f90e4fba7e0a5514cced514d
CVE-2024-30204:
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&amp;id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c
CVE-2024-30203:
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&amp;id=937b9042ad7426acdcca33e3d931d8f495bdd804
CVE-2024-30202:
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&amp;id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9

Regards,
Salvatore

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)

Fwd: GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)

Re: [External] : [oss-security] Fwd: GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)

Re: GNU emacs 29.3 released to fix security issues Salvatore Bonaccorso (Mar 25)

Re: GNU emacs 29.3 released to fix security issues Salvatore Bonaccorso (Mar 25)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->