The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a Local variables declaration.

The hack-local-variable function in Emacs 22 prior to version 22.2, when enable-local-variables is set to ':safe', did not properly search lists of unsafe or risky variables, which could allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a Local variables declaration (CVE-2007-5795; only affects Mandriva Linux 2008.0).

A stack-based buffer overflow in emacs could allow user-assisted attackers to cause an application crash or possibly have other unspecified impacts via a large precision value in an integer format string specifier to the format function (CVE-2007-6109).

The updated packages have been patched to correct these issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have the security update 2008-002 applied. 

This update contains several security fixes for a number of programs.

The remote host is affected by the vulnerability described in GLSA-200712-03 (GNU Emacs: Multiple vulnerabilities)

    Drake Wilson reported that the hack-local-variables() function in GNU     Emacs 22 does not properly match assignments of local variables in a     file against a list of unsafe or risky variables, allowing to override     them (CVE-2007-5795). Andreas Schwab (SUSE) discovered a stack-based     buffer overflow in the format function when handling values with high     precision (CVE-2007-6109).
  Impact :

    Remote attackers could entice a user to open a specially crafted file     in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp     code (via CVE-2007-5795) or arbitrary code (via CVE-2007-6109) with the     privileges of the user running GNU Emacs.
  Workaround :

    The first vulnerability can be worked around by setting the     'enable-local-variables' option to 'nil', disabling the processing of     local variable lists. GNU Emacs prior to version 22 is not affected by     this vulnerability. There is no known workaround for the second     vulnerability at this time.

- Tue Nov 6 2007 Chip Coldwell <coldwell at redhat.com> -     22.1-5

    - fix insufficient safe-mode checks (Resolves: bz367581)

    - Update rpm-spec-mode to the current upstream, drop       compat patch (bz306841)

    - Wed Sep 12 2007 Chip Coldwell <coldwell at redhat.com>
      - 22.1-4

    - require xorg-x11-fonts-ISO8859-1-100dpi instead of       75dpi (Resolves: bz281861)

    - drop broken python mode (Resolves: bz262801)

    - use macro instead of variable style for buildroot.

    - add pkgconfig file.

    - Mon Aug 13 2007 Chip Coldwell <coldwell at redhat.com>
      - 22.1-3

    - add pkgconfig file for emacs-common and virtual       provides (Resolves: bz242176)

    - glibc-open-macro.patch to deal with glibc turning       'open' into a macro.

    - leave emacs info pages in default section (Resolves:
      bz199008)

    - Fri Jul 13 2007 Chip Coldwell <coldwell at redhat.com>
      - 22.1-2

    - change group from Development to Utility

    - Wed Jun 6 2007 Chip Coldwell <coldwell at redhat.com>
      - 22.1-1

    - move alternatives install to posttrans scriptlet       (Resolves: bz239745)

    - new release tarball from FSF (Resolves: bz245303)

    - new php-mode 1.2.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Nov 6 2007 Chip Coldwell <coldwell at redhat.com>     22.1-8

    - fix insufficient safe-mode checks (Resolves: bz367591)

    - Thu Nov 1 2007 Chip Coldwell <coldwell at redhat.com>       22.1-7

    - Update rpm-spec-mode to the current upstream, drop       compat patch (bz306841)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Drake Wilson discovered that Emacs did not correctly handle the safe mode of 'enable-local-variables'. If a user were tricked into opening a specially crafted file while 'enable-local-variables' was set to the non-default ':safe', a remote attacker could execute arbitrary commands with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The setting ':safe' of 'enable-local-variables' could be bypassed by specially crafted files (CVE-2007-5795).

ID	Name	Product	Family	Severity
36420	Mandriva Linux Security Advisory : emacs (MDVSA-2008:034)	Nessus	Mandriva Local Security Checks	critical
31605	Mac OS X Multiple Vulnerabilities (Security Update 2008-002)	Nessus	MacOS X Local Security Checks	critical
29290	GLSA-200712-03 : GNU Emacs: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
28255	Fedora 7 : emacs-22.1-5.fc7 (2007-3056)	Nessus	Fedora Local Security Checks	medium
28254	Fedora 8 : emacs-22.1-8.fc8 (2007-2946)	Nessus	Fedora Local Security Checks	medium
28209	Ubuntu 7.10 : emacs22 vulnerability (USN-541-1)	Nessus	Ubuntu Local Security Checks	medium
27647	openSUSE 10 Security Update : emacs (emacs-4620)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2007-5795

high

Tenable Plugins

critical

critical

critical

medium

medium

medium

medium