Re: Need information regarding Emacs application

[Jean Louis <bugs@gnu.support>]

* Anders Munch <ajm@flonidan.dk> [2024-02-09 18:19]:
> Srinivasan Santhanam wrote:
> > Could you please confirm whether there are any vulnerabilities identified with the latest 29.2 version.
> 
> https://www.opencve.io/cve?vendor=gnu&product=emacs

I would not agree that those CVE reports are propriate to Emacs. 

Let us review few examples:

> CVE-2023-2491 	2 Gnu, Redhat 	5 Emacs, Enterprise Linux, Enterprise Linux Eus and 2 more 	2023-12-10 	N/A 	7.8 HIGH
> A flaw was found in the Emacs text editor. Processing a specially
> crafted org-mode code with the "org-babel-execute:latex" function in
> ob-latex.el can result in arbitrary command execution. This CVE exists
> because of a CVE-2023-28617 security regression for the emacs package
> in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

We have to consider that Emacs has a built-in programming
language. All parts of Emacs can be replaced, or loaded from not only
system files but also private files.

If any attacking user has access to file system, than such user can
provide custom "Org" library or any other library and can impose on
the victim user for that library to do whatever they want.

"A specially crafted key stroke combination can result inn arbitrary
command execution" -- this is also true, so one could file unlimited
number of such non-sensical CVE reports, and I invite people to do
that until group cognition come to place how little it makes sense.

"A specially crafted shell script can result in arbitrary command
execution" -- please think along those lines.

When I keep reading those CVE reports, the more I read, the more it
looks like it only serves some business purposes, not the real
security.

Emacs is programmable editor. Any person who has access to Emacs on
computer is free to do whatever system privileges allow to that
user. And any attacker can send arbitrary files to victim and impose
on the victim to execute such files. 

All that does not mean it is "security issue" and especially not that
it is something to be worried about.

All bugs are reported by M-x report-emacs-bug and are handled
basically promptly. In that sense, Emacs with its professional
developers and millions of users is far more secure system than those
less known editors.

-- 
Jean

Take action in Free Software Foundation campaigns:
https://www.fsf.org/campaigns

In support of Richard M. Stallman
https://stallmansupport.org/