On Mon, Apr 24, 2023 at 09:27:34PM +0000, fuomag9 wrote: > Hi, > > This email was forwarded to you as suggested by simon@josefsson.org as I was forwarded to this person when contacting security@gnu.org > > > > Hi, > I’m a security researcher and I’ve searched for a way to contact the emacs security team but I’ve not found any information online, so I’m reporting this issue here. > I’ve discovered a buffer overflow in GNU Emacs 28.0.50 (at the time of writing the exploit still works on GNU Emacs 28.2) > The issue is inside the --dump-file functionality of emacs, in particular dump_make_lv_from_reloc at pdumper.c:5239 > Attached to this email there's is payload used to make the vulnerability work (if emacs complains about a signature error you need to replace the hex bytes inside the payload with the expected one, since every emacs binary will expect a different signature). [...] Hm. The way I see this: the dump file is part of the Emacs program. Creating a vulnerability by replacing part of a program (e.g. a shared library) seems to be possible everywhere, no? Cheers -- t