FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2012-3479

This CVE name corresponds to:

Entered	Topic
2012-09-08	emacs -- remote code execution vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2012-3479 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2012-3479
Phase	Assigned(20120614)

Description

lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.

References

Source	Reference
MLIST	[oss-security] 20120812 Re: Security flaw in GNU Emacs file-local variables
MLIST	[oss-security] 20120813 Security flaw in GNU Emacs file-local variables
CONFIRM	http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
DEBIAN	DSA-2603
MANDRIVA	MDVSA-2013:076
SLACKWARE	SSA:2012-228-02
SUSE	openSUSE-SU-2012:1348
UBUNTU	USN-1586-1
BID	54969
SECTRACK	1027375
SECUNIA	50157
SECUNIA	50801