Bug 33867 - emacs new security issue CVE-2024-53920
Summary: emacs new security issue CVE-2024-53920
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2024-12-20 09:34 CET by Nicolas Salguero
Modified: 2024-12-24 09:08 CET (History)
3 users (show)

See Also:
Source RPM: emacs-29.4-1.1.mga9.src.rpm
CVE: CVE-2024-53920
Status comment:


Attachments

Nicolas Salguero 2024-12-20 09:35:23 CET

Whiteboard: (none) => MGA9TOO
Source RPM: (none) => emacs-29.4-5.mga10.src.rpm, emacs-29.4-1.1.mga9.src.rpm
Status comment: (none) => Patch available from openSUSE
CVE: (none) => CVE-2024-53920

Comment 1 Nicolas Salguero 2024-12-20 12:32:14 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code). (CVE-2024-53920)

References:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/P4KYDPPUCZHJVNAEXLQAF43YKVZPVWFH/
========================

Updated packages in core/updates_testing:
========================
emacs-29.4-1.2.mga9
emacs-common-29.4-1.2.mga9
emacs-doc-29.4-1.2.mga9
emacs-el-29.4-1.2.mga9
emacs-leim-29.4-1.2.mga9
emacs-nox-29.4-1.2.mga9
emacs-pgtk-29.4-1.2.mga9

from SRPM:
emacs-29.4-1.2.mga9.src.rpm

Source RPM: emacs-29.4-5.mga10.src.rpm, emacs-29.4-1.1.mga9.src.rpm => emacs-29.4-1.1.mga9.src.rpm
Assignee: bugsquad => qa-bugs
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)
Status comment: Patch available from openSUSE => (none)
Version: Cauldron => 9

katnatek 2024-12-20 21:07:41 CET

Keywords: (none) => advisory

Comment 2 katnatek 2024-12-20 21:32:11 CET
RH x86_64

Confirm the vulnerability

installing emacs-common-29.4-1.2.mga9.x86_64.rpm emacs-29.4-1.2.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: emacs-common          ##################################################################################################
      2/2: emacs                 ##################################################################################################
      1/2: removing emacs-29.4-1.1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing emacs-common-29.4-1.1.mga9.x86_64
                                 ##################################################################################################

The test for the vulnerability show is now fixed

OK for me
Comment 3 Herman Viaene 2024-12-21 15:21:25 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Never used this, so opened it, read some of the tutorial, refused to learn all the keyinputs (makes me think of DOS programs long gone).
Just able to add a line to a txt file, save, reopen, check the change, delete it and save again to its original text.
If katnatek is happy with, that, bless him. I'm running away as far  as I can. Basically it works, so affirm the OK above.

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Comment 4 Thomas Andrews 2024-12-21 21:41:00 CET
Thank you, Herman.

I tried this for an MGA8 update a while back, did about what you did, and also refused to learn all the keyinputs, as well - it's just not something I'm going to use much. I was going to look at it again in VirtualBox for this bug, but you saved me from all that.

Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update

Comment 5 Mageia Robot 2024-12-24 09:08:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2024-0397.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.