oss-sec mailing list archives
Re: GNU emacs 29.3 released to fix security issues
From: Salvatore Bonaccorso <carnil () debian org>
Date: Mon, 25 Mar 2024 11:12:56 +0100
Hi, On Sun, Mar 24, 2024 at 09:05:20AM -0700, Alan Coopersmith wrote:
https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html reports:Version 29.3 of Emacs, the extensible text editor, should now be available from your nearest GNU mirror: https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.xz https://ftpmirror.gnu.org/emacs/emacs-29.3.tar.gz[...] Emacs 29.3 is an emergency bugfix release; it includes no new features except a small number of changes intended to resolve security vulnerabilities uncovered in Emacs 29.2. See the file etc/NEWS in the tarball; you can view it from Emacs by typing 'C-h n', or by clicking Help->Emacs News from the menu bar. You can also browse NEWS on-line using this URL: https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29 For the complete list of changes and the people who made them, see the various ChangeLog files in the source distribution. For a summary of all the people who have contributed to Emacs, see the etc/AUTHORS file. For more information about Emacs, see: https://www.gnu.org/software/emacshttps://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29 lists these changes:* Changes in Emacs 29.3 Emacs 29.3 is an emergency bugfix release intended to fix several security vulnerabilities described below. ** Arbitrary Lisp code is no longer evaluated as part of turning on Org mode. This is for security reasons, to avoid evaluating malicious Lisp code. ** New buffer-local variable 'untrusted-content'. When this is non-nil, Lisp programs should treat buffer contents with extra caution. ** Gnus now treats inline MIME contents as untrusted. To get back previous insecure behavior, 'untrusted-content' should be reset to nil in the buffer. ** LaTeX preview is now by default disabled for email attachments. To get back previous insecure behavior, set the variable 'org--latex-preview-when-risky' to a non-nil value. ** Org mode now considers contents of remote files to be untrusted. Remote files are recognized by calling 'file-remote-p'.The detailed changelogs are at: https://git.savannah.gnu.org/cgit/emacs.git/tree/ChangeLog.4?h=emacs-29
Related to this there is as well an org-mode update: https://list.orgmode.org/87o7b3eczr.fsf () bzg fr/T/#t quoting that post:
I just released Org mode 9.6.23 that fixes several critical vulnerabilities. The release is coordinated with emergency Emacs 29.3 release (https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html). Please upgrade your Org mode *and* Emacs ASAP. The vulnerabilities involve arbitrary Elisp and LaTeX evaluation when previewing attachments in Emacs or when opening third-party Org files. The arbitrary Elisp evaluation is fixed by this release. The fix for LaTeX evaluation requires Emacs 29.3 and will not work for the earlier Emacs versions. If upgrading Emacs is not viable, as a workaround, you can set `org-preview-latex-default-process' to 'verbatim - this will disable LaTeX previews and avoid the vulnerability.
I believe CVE assignments are yet missing. RedHat folks, can you assign CVEs as needed for the individual emacs and org-mode issues? Regards, Salvatore
Current thread:
- GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)
- Fwd: GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)
- Re: [External] : [oss-security] Fwd: GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)
- Re: GNU emacs 29.3 released to fix security issues Salvatore Bonaccorso (Mar 25)
- Re: GNU emacs 29.3 released to fix security issues Salvatore Bonaccorso (Mar 25)
- Fwd: GNU emacs 29.3 released to fix security issues Alan Coopersmith (Mar 24)