Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1222114

Bug#1088690: emacs: CVE-2024-53920

Show all headers | View raw

Source: emacs
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for emacs. This is no fix
and this is a long-standing issue, so mostly filing a bug for
transparency for now:

CVE-2024-53920[0]:
| In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to
| invoke elisp-completion-at-point (for code completion) on untrusted
| Emacs Lisp source code can trigger unsafe Lisp macro expansion that
| allows attackers to execute arbitrary code. (This unsafe expansion
| also occurs if a user chooses to enable on-the-fly diagnosis that
| byte compiles untrusted Emacs Lisp source code.)

https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg%40mail.gmail.com/


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-53920
    https://www.cve.org/CVERecord?id=CVE-2024-53920

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1088690: emacs: CVE-2024-53920 Moritz Mühlenhoff <jmm@inutil.org> - 2024-11-29 17:30 +0100
  Bug#1088690: emacs: CVE-2024-53920 flymake/flycheck Max Nikulin <manikulin@gmail.com> - 2025-01-23 15:50 +0100

csiph-web