From: Stefan Kangas <stefan@marxist.se>
To: adam plaice <plaice.adam+lists@gmail.com>
Cc: 37656@debbugs.gnu.org, Emacs developers <emacs-devel@gnu.org>
Subject: Re: bug#37656: 27.0.50; Arbitrary code execution with special `mode:'
Date: Wed, 16 Oct 2019 00:27:18 +0200 [thread overview]
Message-ID: <CADwFkmnqfbsEEWkWMA2xnN1O+-JsTcCKrSYv0e3g1+jXrxRY5g@mail.gmail.com> (raw)
In-Reply-To: <CAJw81dZZmX=z-YFDwvEkuWR6xH+cf=mR9h-fcZTphwdXWrA5wg@mail.gmail.com>
adam plaice <plaice.adam+lists@gmail.com> writes:
> Since the bug allows an attacker to execute arbitrary code if the
> victim opens a payload file, and hence opening any file from an
> untrusted source becomes dangerous, it seems to be rather
> serious.
Thanks for raising this here. I agree that this is serious, and we
should treat it accordingly.
The below patch seems to fix it by disabling the feature it exploits.
A workaround is to add this to your init file:
(setq enable-local-variables nil)
Best regards,
Stefan Kangas
diff --git a/lisp/files.el b/lisp/files.el
index 40807617fa..550227b21a 100644
--- a/lisp/files.el
+++ b/lisp/files.el
@@ -3068,7 +3068,7 @@ set-auto-mode
(if (save-excursion (search-forward ":" end t))
;; Find all specifications for the `mode:' variable
;; and execute them left to right.
- (while (let ((case-fold-search t))
+ (when (let ((case-fold-search t))
(or (and (looking-at "mode:")
(goto-char (match-end 0)))
(re-search-forward "[ \t;]mode:" end t)))
next prev parent reply other threads:[~2019-10-15 22:27 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-15 21:05 bug#37656: 27.0.50; Arbitrary code execution with special `mode:' adam plaice
2019-10-15 22:23 ` Clément Pit-Claudel
2019-10-15 22:27 ` Stefan Kangas [this message]
2019-10-15 22:55 ` Stefan Kangas
2019-10-15 23:17 ` Stefan Kangas
2019-10-16 7:58 ` Eli Zaretskii
2019-10-16 11:51 ` Adam Plaice
2019-10-16 17:09 ` Eli Zaretskii
2019-10-16 19:09 ` Phil Sainty
2019-10-16 19:34 ` Eli Zaretskii
2019-10-16 21:02 ` Adam Plaice
2019-10-15 23:17 ` Stefan Kangas
2019-10-16 0:35 ` Adam Plaice
2019-10-16 7:57 ` Eli Zaretskii
2019-10-16 0:55 ` Phil Sainty
2019-10-16 0:55 ` Phil Sainty
2019-10-16 7:59 ` Eli Zaretskii
2019-10-15 22:27 ` Stefan Kangas
2019-10-16 6:43 ` Eli Zaretskii
-- strict thread matches above, loose matches on Subject: below --
2019-10-08 8:48 bug#37656: 27.0.50; Opening file with specially crafted local variables can cause arbitrary code execution Inbox x adam plaice
2019-10-15 21:05 ` bug#37656: 27.0.50; Arbitrary code execution with special `mode:' adam plaice
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CADwFkmnqfbsEEWkWMA2xnN1O+-JsTcCKrSYv0e3g1+jXrxRY5g@mail.gmail.com \
--to=stefan@marxist.se \
--cc=37656@debbugs.gnu.org \
--cc=emacs-devel@gnu.org \
--cc=plaice.adam+lists@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.