Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #5279 > unrolled thread
| Started by | Bjørn Mork <bjorn@mork.no> |
|---|---|
| First post | 2017-09-13 09:50 +0200 |
| Last post | 2017-09-13 10:00 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.debian.security
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Re: [DSA 3970-1] emacs24 security update Bjørn Mork <bjorn@mork.no> - 2017-09-13 09:50 +0200
Re: [DSA 3970-1] emacs24 security update Salvatore Bonaccorso <carnil@debian.org> - 2017-09-13 10:00 +0200
| From | Bjørn Mork <bjorn@mork.no> |
|---|---|
| Date | 2017-09-13 09:50 +0200 |
| Subject | Re: [DSA 3970-1] emacs24 security update |
| Message-ID | <upaAO-4oC-21@gated-at.bofh.it> |
Moritz Muehlenhoff <jmm@debian.org> writes: > Package : emacs24 > CVE ID : not yet available > > Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code > execution when rendering text/enriched MIME data (e.g. when using > Emacs-based mail clients). > > For the oldstable distribution (jessie), this problem has been fixed > in version 24.4+1-5+deb8u1. > > For the stable distribution (stretch), this problem has been fixed in > version 24.5+1-11+deb9u1. What about emacs25 in stretch? AFAICS, it is still vulnerable. https://bugs.debian.org/875447 was closed with the upload of 25.2+1-6 to unstable, but this bug was opened against 25.1+1-4 which still is the current version in stretch. And needs fixing ASAP... Bjørn
[toc] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2017-09-13 10:00 +0200 |
| Message-ID | <upaKu-4rT-11@gated-at.bofh.it> |
| In reply to | #5279 |
Hi! On Wed, Sep 13, 2017 at 09:10:52AM +0200, Bjørn Mork wrote: > Moritz Muehlenhoff <jmm@debian.org> writes: > > > Package : emacs24 > > CVE ID : not yet available > > > > Charles A. Roelli discovered that Emacs is vulnerable to arbitrary code > > execution when rendering text/enriched MIME data (e.g. when using > > Emacs-based mail clients). > > > > For the oldstable distribution (jessie), this problem has been fixed > > in version 24.4+1-5+deb8u1. > > > > For the stable distribution (stretch), this problem has been fixed in > > version 24.5+1-11+deb9u1. > > What about emacs25 in stretch? AFAICS, it is still vulnerable. > > https://bugs.debian.org/875447 was closed with the upload of 25.2+1-6 to > unstable, but this bug was opened against 25.1+1-4 which still is the > current version in stretch. And needs fixing ASAP... Yes the same update is planned and will go out shortly. Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web