oss-sec mailing list archives
Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability
From: Chong Yidong <cyd () gnu org>
Date: Tue, 10 Jan 2012 11:54:55 +0800
Kurt Seifried <kseifried () redhat com> writes:
I'll assign this a CVE once I have determined the code base status (are these considered the same codebase, or have they forked enough to be considered separate code bases? Also I need to ensure this hasn't already been assigned a CVE. CC'ing relevant developers as well.
No, this hasn't already been assigned a CVE. The upstream CEDET 1.0 is largely the same codebase as the CEDET distributed in Emacs. The version in Emacs omits some CEDET components, and added some plumbing to integrate CEDET into the Emacs build system. But the main part of the Emacs Lisp code, including the part affected by this flaw, is the same. David, could you write up a version of the fix that applies to the CEDET 1.0 tarball? I think distributors who package CEDET will want it.
Current thread:
- CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability Kurt Seifried (Jan 09)
- Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability Chong Yidong (Jan 09)
- Re: Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability Kurt Seifried (Jan 09)
- Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability David Engster (Jan 11)
- Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability Chong Yidong (Jan 09)