| Summary: | emacs new security issue CVE-2022-45939 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, nicolas.salguero, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | emacs-27.1-1.1.mga8.src.rpm | CVE: | CVE-2022-45939 |
| Status comment: | |||
|
Description
David Walser
2022-12-01 15:09:57 CET
David Walser
2022-12-01 15:10:17 CET
Whiteboard:
(none) =>
MGA8TOO Equivalent openSUSE advisory: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU2KN46JJ6TL6CR5QN3O4AZXDYE35Z7A/ emacs is maintained by all sorts of people, so assigning this bug globally. Assignee:
bugsquad =>
pkg-bugs Suggested advisory: ======================== The updated packages fix security vulnerabilities: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. (CVE-2022-45939) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45939 https://lists.suse.com/pipermail/sle-security-updates/2022-December/013180.html https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU2KN46JJ6TL6CR5QN3O4AZXDYE35Z7A/ ======================== Updated packages in core/updates_testing: ======================== emacs-27.1-1.2.mga8 emacs-common-27.1-1.2.mga8 emacs-doc-27.1-1.2.mga8 emacs-el-27.1-1.2.mga8 emacs-leim-27.1-1.2.mga8 emacs-nox-27.1-1.2.mga8 from SRPM: emacs-27.1-1.2.mga8.src.rpm Status comment:
Patch available from upstream =>
(none) No installation issues. Wikipedia says that there are over 10,000 commands for emacs. I did not try very many of them. I'm not an emacs user as a rule, but if I were I'd mostly be using it as a text editor. So, I loaded a text file into it, edited the file, and saved it successfully, and emacs kept the old file for me automatically as a backup. Reading that emacs is designed to be used with keyboad rather than mouse, I loaded the text file and tried a few commands. While some did not do what I expected, it looked like I should have expected them to do what they did. Giving this an OK, for now. If someone with more emacs experience doesn't come along to say different, I'll validate in a day or two. Whiteboard:
(none) =>
MGA8-64-OK
Dave Hodgins
2022-12-13 01:59:57 CET
CC:
(none) =>
davidwhodgins An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0457.html Status:
ASSIGNED =>
RESOLVED |