Lack of data validation In emacs
Description
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 1:27.1+1-3.1+deb11u6 | ||
debian 13 | 1:30.1+1-1 | ||
debian 14 | 1:30.1+1-1 | ||
debian 12 | 1:28.2+1-15+deb12u4 | ||
 rpm rhel7 | - | - | |
rpm rhel9.4 | 1:27.2-10.el9_4.2 | ||
rpm rhel9.2 | 1:27.2-8.el9_2.3 | ||
rpm rhel6 | - | - | |
rpm rhel9 | 1:27.2-14.el9_6.2 | ||
rpm rhel8 | 1:26.1-15.el8_10 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3. 4.