REDHAT-BUG-2459992: Buffer Overflow
Off-by-one heap buffer overflow and uninitialized heap read in GNU Emacs src/image.c svgloadimage() when processing SVG CSS. The null terminator is written one byte past the allocation. Affected: Emacs 28.1 through 30.2. Fixed upstream on emacs-30: commit 8f535370b9.
Public bug: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=80851
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GNU Emacsto a version that resolves this vulnerability.Fixed in 8f535370b9 - Upgrade
Upgrade
GNU Emacsto a version that resolves this vulnerability.Fixed in 30.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2459992?
The severity of REDHAT-BUG-2459992 is high due to the potential for an off-by-one heap buffer overflow, which can lead to memory corruption.
How do I fix REDHAT-BUG-2459992?
To fix REDHAT-BUG-2459992, upgrade GNU Emacs to version 30.3 or later, which includes the necessary patch.
Which versions of software are affected by REDHAT-BUG-2459992?
REDHAT-BUG-2459992 affects GNU Emacs versions from 28.1 to 30.2.
What causes the vulnerability in REDHAT-BUG-2459992?
The vulnerability in REDHAT-BUG-2459992 is caused by an off-by-one error in the allocation of memory when processing SVG CSS.
Is there a known exploit for REDHAT-BUG-2459992?
As of now, there are no known public exploits specifically targeting REDHAT-BUG-2459992.