- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 201801-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                           https://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



 Severity: Normal

    Title: GNU Emacs: Command injection

     Date: January 07, 2018

     Bugs: #630680

       ID: 201801-07



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



A vulnerability has been found in Emacs which may allow for arbitrary

command execution.



Background

==========



GNU Emacs is a highly extensible and customizable text editor.



Affected packages

=================



    -------------------------------------------------------------------

     Package              /     Vulnerable     /            Unaffected

    -------------------------------------------------------------------

  1  app-editors/emacs         < 23.4-r16:23           >= 23.4-r16:23 

                                < 24.5-r4:24            >= 24.5-r4:24 

                                < 25.2-r1:25            >= 25.2-r1:25 



Description

===========



A command injection flaw within the Emacs "enriched mode" handling has

been discovered.



Impact

======



A remote attacker, by enticing a user to open a specially crafted file,

could execute arbitrary commands with the privileges of process.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All GNU Emacs 23.x users should upgrade to the latest version:



  # emerge --sync

  # emerge --ask --oneshot --verbose ">=app-editors/emacs-23.4-r16"



All GNU Emacs 24.x users should upgrade to the latest version:



  # emerge --sync

  # emerge --ask --oneshot --verbose ">=app-editors/emacs-24.5-r4"



All GNU Emacs 25.x users should upgrade to the latest version:



  # emerge --sync

  # emerge --ask --oneshot --verbose ">=app-editors/emacs-,25.2-r1"



References

==========



[ 1 ] CVE-2017-14482

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14482



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



 https://security.gentoo.org/glsa/201801-07



--nextPart4927752.KoUlrzh7sL

Content-Type: application/pgp-signature; name="signature.asc"

Content-Description: This is a digitally signed message part.

Content-Transfer-Encoding: 7Bit



-----BEGIN PGP SIGNATURE-----



iQEzBAABCAAdFiEEiDRK3jyVBE/RkymqpRQw84X1dt0FAlpSscgACgkQpRQw84X1

dt1vaAf/bNtCOVd7/21yp/suIIuUHaGWP6OveoRdeqlcusRGDEtMW/Gv5HPegNnA

gN3zwOKYod+aNcmX1YV6q8JzTafMpr0JY5ApIh00VqDesiUraP6XgJcf6TNeazZ1

rjjA+dqAIPcrH2AQam2LU90e/JVi+gDyZYMzNtmfEJZS0LnUYcRr1SUsreO8NYd6

cjznOaxtqzO8lyjcxPpAbDTRJNlcjzokgJ9p2AkNllFBKIhuaf0sw6NKHWBG0UuF

hweC01Jpsf3UZJhNe0B7DPkpdBwucZ2W2INVeOXqPz41BhFly7QostwNRFaln2io

jxMNY3mqYZ/jTc084HJMqkmUUBdk2A==

=8QaH

-----END PGP SIGNATURE-----



--nextPart4927752.KoUlrzh7sL--