Re: CVE request: Emacs 21 fast-lock-mode arbitrary lips code execution

[Robert Buchholz <rbu () gentoo org>]

Hey Nico,

On Monday, 12. May 2008, Nico Golde wrote:
> * Robert Buchholz <rbu () gentoo org> [2008-05-12 19:05]:
> > On Monday, 12. May 2008, Nico Golde wrote:
> > > * Robert Buchholz <rbu () gentoo org> [2008-05-10 15:01]:
> > > > Emacs 21 and Xemacs will execute any lisp code present in a .flc
> > > > file that accompanies the file the user opens.
> > >
> > > The same applies to emacs22.
> >
> > Our emacs maintainer said version 22 would warn you that lisp code
> > from the file would be executed. Could you confirm otherwise?
>
> At least not with the emacs22 installation I tried this with (22.2).
> As this is a rather old version, this may depend on the
> version used?

The 22.2 is only a few weeks old, is it not?

Anyway, Ulrich Mueller (who is in CC) clarified the behaviour, I quote:

> the issue may still occur in Emacs 22, if both of the following
> conditions are fulfilled:
> - the user sets fast-lock-mode as support mode for font-lock (which is
>   not the default),
> - the user explicitely loads fast-lock, ignoring the warning ("Package
>   fast-lock is obsolete").

I could not reproduce the issue in Emacs 22.2 with only the changed 
configuration either, but maybe I just used Emacs the wrong way.


Robert

Attachment: signature.asc
Description: This is a digitally signed message part.