emacs23 vulnerabilities

27 September 2012

emacs23 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 12.04 LTS
• Ubuntu 11.10

Summary

Emacs could be made to run programs as your login if it opened a specially crafted file.

Software Description

• emacs23 - The GNU Emacs editor (with GTK+ user interface)

Details

Hiroshi Oota discovered that Emacs incorrectly handled search paths. If a user were tricked into opening a file with Emacs, a local attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-0035)

Paul Ling discovered that Emacs incorrectly handled certain eval forms in local-variable sections. If a user were tricked into opening a specially crafted file with Emacs, a remote attacker could execute arbitrary Lisp code with the privileges of the user invoking the program. (CVE-2012-3479)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 12.04 LTS

emacs23 - 23.3+1-1ubuntu9.1

emacs23-common - 23.3+1-1ubuntu9.1

Ubuntu 11.10

emacs23 - 23.3+1-1ubuntu4.1

emacs23-common - 23.3+1-1ubuntu4.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Emacs to make all the necessary changes.

References

• CVE-2012-0035
• CVE-2012-3479