60 matches found
emacs protection bypass
"enable-local-variables" doesn't work...
[slackware-security] emacs
New emacs packages are available for Slackware 13.1, 13.37, and -current to fix a security issue. Here are the details from the Slackware 13.37 ChangeLog: patches/packages/emacs-23.3-i486-2slack13.37.txz: Rebuilt. Patched to fix a security flaw in the file-local variables code. When the Emacs use...
emacs -- remote code execution vulnerability
Chong Yidong reports: Paul Ling has found a security flaw in the file-local variables code in GNU Emacs. When the Emacs user option enable-local-variables' is set to :safe' the default value is t, Emacs should automatically refuse to evaluate eval' forms in file-local variable sections. Due to th...
CVE-2011-2719
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain...
Possible superglobal and local variables manipulation in swekey authentication.
PMASA-2011-12 Announcement-ID: PMASA-2011-12 Date: 2011-07-23 Updated: 2011-07-25 Summary Possible superglobal and local variables manipulation in swekey authentication. Description It was possible to manipulate the PHP superglobals including SESSION using some of the Swekey authentication code...
Buffer overflow in JavaScript upvarMap — Mozilla
Security researcher Christian Holler reported that the JavaScript engine's internal memory mapping of non-local JS variables contained a buffer overflow which could potentially be used by an attacker to run arbitrary code on a victim's computer...
GNU Emacs: Multiple vulnerabilities
Background GNU Emacs is a highly extensible and customizable text editor. Description Drake Wilson reported that the hack-local-variables function in GNU Emacs 22 does not properly match assignments of local variables in a file against a list of unsafe or risky variables, allowing to override the...
Ubuntu 7.10 : emacs22 vulnerability (USN-541-1)
Drake Wilson discovered that Emacs did not correctly handle the safe mode of 'enable-local-variables'. If a user were tricked into opening a specially crafted file while 'enable-local-variables' was set to the non-default ':safe', a remote attacker could execute arbitrary commands with the user's...
openSUSE 10 Security Update : emacs (emacs-4620)
The setting ':safe' of 'enable-local-variables' could be bypassed by specially crafted files CVE-2007-5795. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update emacs-4620. The text description of...
CVE-2007-5795
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
Design/Logic Flaw
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
CVE-2007-5795
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
CVE-2007-5795
The hack-local-variables function in Emacs before 22.2, when enable-local-variables is set to :safe, does not properly search lists of unsafe or risky variables, which might allow user-assisted attackers to bypass intended restrictions and modify critical program variables via a file containing a...
Debian DSA-897-1 : phpsysinfo - programming errors
Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-0870 Maksymilian Arciemowicz discovered several cross site scripting problems, of which not all wer...
Debian DSA-898-1 : phpgroupware - programming errors
Several vulnerabilities have been discovered in phpsysinfo, a PHP based host information application that is included in phpgroupware. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-0870 Maksymilian Arciemowicz discovered several cross site scripti...
[SECURITY] [DSA 897-1] New phpsysinfo packages fix several vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 897-1 [email protected] http://www.debian.org/security/ Martin Schulze November 15th, 2005 http://www.debian.org/security/faq -...
DSA-897-1 phpsysinfo - programming errors
Bulletin has no description...
CVE-2003-1232
Emacs 21.2.1 does not prompt or warn the user before executing Lisp code in the local variables section of a text file, which allows user-assisted attackers to execute arbitrary commands, as demonstrated using the mode-name variable...
Emacs 2.1 - Local Variable Arbitrary Command Execution
source: https://www.securityfocus.com/bid/15375/info Emacs is susceptible to an arbitrary command execution vulnerability with local variables. This issue is due to insufficient sanitization of user-supplied input. By modifying a text file to include local variables containing containing shell...