Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5280

Re: [DSA 3970-1] emacs24 security update

Show all headers | View raw

Hi!

On Wed, Sep 13, 2017 at 09:10:52AM +0200, Bjørn Mork wrote:
> Moritz Muehlenhoff <jmm@debian.org> writes:
> 
> > Package        : emacs24
> > CVE ID         : not yet available
> >
> > Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code
> > execution when rendering text/enriched MIME data (e.g. when using
> > Emacs-based mail clients).
> >
> > For the oldstable distribution (jessie), this problem has been fixed
> > in version 24.4+1-5+deb8u1.
> >
> > For the stable distribution (stretch), this problem has been fixed in
> > version 24.5+1-11+deb9u1.
> 
> What about emacs25 in stretch?  AFAICS, it is still vulnerable.
> 
> https://bugs.debian.org/875447 was closed with the upload of 25.2+1-6 to
> unstable, but this bug was opened against 25.1+1-4 which still is the
> current version in stretch.  And needs fixing ASAP...

Yes the same update is planned and will go out shortly.

Regards,
Salvatore

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Re: [DSA 3970-1] emacs24 security update Bjørn Mork <bjorn@mork.no> - 2017-09-13 09:50 +0200
  Re: [DSA 3970-1] emacs24 security update Salvatore Bonaccorso <carnil@debian.org> - 2017-09-13 10:00 +0200

csiph-web