[Bug: 21.5-b28] .flc files can run arbitrary code automatically
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1998 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
================================================================
Dear Bug Team!
The attached message was seen on emacs-devel. Claimed to affect
XEmacs too.
================================================================
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://calypso.tux.org/cgi-bin/mailman/listinfo/xemacs-beta
Attachments:
- welinder.bug (message/rfc822 — 52 bytes)
On Saturday 10 May 2008, Stephen J. Turnbull wrote:
The attached message was seen on emacs-devel. Claimed to affect
XEmacs too.
Patch in Gentoo bug tracker looks sane to me, I haven't tested it though.
http://bugs.gentoo.org/show_bug.cgi?id=221197#c15
The new security explanation in the docstring could be improved though - using
the file's current dir is just one bad choice. Maybe better:
"This list should contain only trusted directories in order to avoid
reading/executing potentially malicious cache files."
Norbert, WDYT?
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://calypso.tux.org/cgi-bin/mailman/listinfo/xemacs-beta
On Thu, 05 Jun 2008 21:31:19 +0300, Ville Skyttä wrote:
On Saturday 10 May 2008, Stephen J. Turnbull wrote:
> The attached message was seen on emacs-devel. Claimed to affect XEmacs
> too.
Patch in Gentoo bug tracker looks sane to me, I haven't tested it
though.
http://bugs.gentoo.org/show_bug.cgi?id=221197#c15
The new security explanation in the docstring could be improved though -
using the file's current dir is just one bad choice. Maybe better:
"This list should contain only trusted directories in order to avoid
reading/executing potentially malicious cache files."
Norbert, WDYT?
It would be great to get a new package released with a fix for this bug
ASAP.
Given the status of the security bug for Gentoo something needs to happen
soon, and without a released new package that means either dropping edit-
utils (not a real option), or creating a Gentoo-specific new package.
While the latter is feasible I'd much rather just use a new XEmacs
package.
Kind regards,
Hans
_______________________________________________
XEmacs-Beta mailing list
XEmacs-Beta(a)xemacs.org
http://calypso.tux.org/cgi-bin/mailman/listinfo/xemacs-beta
6012
days inactive
6041
days old
2 comments
3 participants
tags (0)
participants (3)
-
Hans de Graaff -
Stephen J. Turnbull -
Ville Skyttä