REDHAT-BUG-1490409: High severity gnu emacs vulnerability
Enriched mode implements an extension command to the text/enriched format called "x-display", which stores "display" text properties. It's possible to use this extension command to transparently execute arbitrary code in an Emacs process that opens a text/enriched file.
Upstream issue:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350
Upstream patch:
https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70
References:
http://seclists.org/oss-sec/2017/q3/422
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1490409?
The severity of REDHAT-BUG-1490409 is critical due to the ability to execute arbitrary code.
How do I fix REDHAT-BUG-1490409?
To fix REDHAT-BUG-1490409, update to a version of GNU Emacs later than 25.
What versions of Emacs are affected by REDHAT-BUG-1490409?
All versions of GNU Emacs prior to version 25 are affected by REDHAT-BUG-1490409.
What is the impact of REDHAT-BUG-1490409?
The impact of REDHAT-BUG-1490409 allows an attacker to execute arbitrary code when a user opens a specially crafted text/enriched file.
Is there a workaround for REDHAT-BUG-1490409?
A workaround for REDHAT-BUG-1490409 is to avoid opening text/enriched files until the vulnerability is patched.