From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED!not-for-mail From: Narendra Joshi Newsgroups: gmane.emacs.help Subject: Re: CVE-2017-14482 - Red Hat Customer Portal Date: Wed, 27 Sep 2017 00:14:41 +0530 Message-ID: <877ewle1uu.fsf@gmail.com> References: <2e991bb7-c570-49ce-be94-3654945bb4b5@mousecar.com> <87d16jxjz6.fsf@eps142.cdf.udc.es> <861smzcgx3.fsf@zoho.com> <1b3bec6e-d4d5-37a7-ba54-49bd2d8281bd@yandex.com> <87377dtw33.fsf@qcore> <83zi9la78x.fsf@gnu.org> <9uvak9ib98.fsf@fencepost.gnu.org> NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain X-Trace: blaine.gmane.org 1506451413 26149 195.159.176.226 (26 Sep 2017 18:43:33 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Tue, 26 Sep 2017 18:43:33 +0000 (UTC) User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) Cc: help-gnu-emacs@gnu.org To: Glenn Morris Original-X-From: help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane.org@gnu.org Tue Sep 26 20:43:30 2017 Return-path: Envelope-to: geh-help-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by blaine.gmane.org with esmtp (Exim 4.84_2) (envelope-from ) id 1dwupJ-0006KC-LZ for geh-help-gnu-emacs@m.gmane.org; Tue, 26 Sep 2017 20:43:25 +0200 Original-Received: from localhost ([::1]:50714 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dwupQ-0002S1-WE for geh-help-gnu-emacs@m.gmane.org; Tue, 26 Sep 2017 14:43:33 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:48141) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dwuop-0002MO-3y for help-gnu-emacs@gnu.org; Tue, 26 Sep 2017 14:42:55 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dwuom-0007Y1-1C for help-gnu-emacs@gnu.org; Tue, 26 Sep 2017 14:42:55 -0400 Original-Received: from mail-pg0-x241.google.com ([2607:f8b0:400e:c05::241]:35429) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dwuol-0007WP-QW; Tue, 26 Sep 2017 14:42:51 -0400 Original-Received: by mail-pg0-x241.google.com with SMTP id j16so7228202pga.2; Tue, 26 Sep 2017 11:42:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version; bh=UVx5Z+n0h5r8WB/zKiO7qCdivyrd101KL0rUKaJqn30=; b=RsYVr39615HB8HCsOomZV6j3bYUOiNhgW3wVYCIbMgalWpxZxSAvL5/pCyplnSFORb zhFnV9RE8JMHdzySNKPICuO6//qB9FYJlT72+InyV+xsrPi9L69eCn+ZiWo8Sr2PbmYi jnjIcElqUXHYfP60Ty5v1u/oJKvFzN5wnZQ+qI2jMdAmYRyfTXbBya2NMrzE3mAP1kGy cTrhEQ5C8/Y+/BJyX9MNXlCghWMaQ2gunHDtZjaeLv27rswXnCmPHgn5EDhXWwu86vjW iiUV7VZ9q8xvS+AkC/QT5ycBGtOvOtA8DBxB7FzUC8/O+UP3qDJpXH6DJlZ/DMehLLyw Ulow== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version; bh=UVx5Z+n0h5r8WB/zKiO7qCdivyrd101KL0rUKaJqn30=; b=pqd8skvQJB2LT3OVsDeehxDA5QqvTkviMFTENjPCDaPue4mwx1DGFpyaH3kfPYMTIf +P4EQO/82zqSg8pYnQMevwhfzdVgR+Iu+G0LXojMA1iPe1k1/mJ2vsVSQxcf2Utfp27q a/N8nY8qQP77B0U9fufsJdIQLMMPv8J6MMwTIHnEQW/cqKkOmA740nSIKmaTAgbYRik8 XOeYFLNHgtEVfgR8SXjSve5+iIHkWWiv7Hjn00oUuWY6ezbodDYrcYbvfoA0nEvj97tg kbicLGbUbWulsM1PXQKGcUMPQGRKf44c1wbiGlB18kA81RPOEndOU5cRjpMj6MXxW+6t lRpQ== X-Gm-Message-State: AHPjjUjLchNV1ImyUXozjmR656h3Fc1C5L9OXnSuyhsTtmcQEjhljfTB XI8EE6fZ6s8V1BrFdAoMFki6gQ0= X-Google-Smtp-Source: AOwi7QCPNjwYH6wCrlihF69t99AR6JCOTXM1CljmygWObQwoeR/n3cxmg701fgXHQPw17NVn2yvdRg== X-Received: by 10.98.64.193 with SMTP id f62mr4975044pfd.297.1506451369045; Tue, 26 Sep 2017 11:42:49 -0700 (PDT) Original-Received: from vicarie ([1.23.210.133]) by smtp.gmail.com with ESMTPSA id f9sm18601364pfe.150.2017.09.26.11.42.46 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 26 Sep 2017 11:42:48 -0700 (PDT) In-Reply-To: <9uvak9ib98.fsf@fencepost.gnu.org> (Glenn Morris's message of "Sat, 23 Sep 2017 13:18:59 -0400") X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2607:f8b0:400e:c05::241 X-BeenThere: help-gnu-emacs@gnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: Users list for the GNU Emacs text editor List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: help-gnu-emacs-bounces+geh-help-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "help-gnu-emacs" Xref: news.gmane.org gmane.emacs.help:114427 Archived-At: Glenn Morris writes: > Eli Zaretskii wrote: > >> But they don't tell the whole story: the vulnerability was actually >> caused by Gnus, MH-E, and perhaps other MUAs who decided to >> automatically support enriched text, without checking the code first. >> Otherwise, enriched.el per se has/had no problem whatsoever. > > I disagree. Simply opening a file in an unpatched Emacs can run > arbitrary code with zero prompting. This is a massive security risk that > is entirely internal to enriched.el (possibly with the 'display property > more generally). It does get worse that Gnus would trust enriched.el to > decode mail messages too. But anyone using Emacs from 21.1 to 25.2 I just checked my Emacs version and its ``` GNU Emacs 27.0.50 (build 1, x86_64-pc-linux-gnu, X toolkit, Xaw3d scroll bars) of 2017-09-17 ``` Are we going to skip Emacs 26? > should be aware of this issue, whether or not they use Emacs for mail. > -- Narendra Joshi