bugtraq - [ MDVSA-2014:118 ] emacs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1WuObc-0006fS-M3@titan.mandriva.com>
Date: Tue, 10 Jun 2014 18:09:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2014:118 ] emacs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:118
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : emacs
 Date    : June 10, 2014
 Affected: Business Server 1.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Updated emacs packages fix security vulnerabilities:
 
 Steve Kemp discovered multiple temporary file handling issues in
 Emacs. A local attacker could use these flaws to perform symbolic link
 attacks  against users running Emacs (CVE-2014-3421, CVE-2014-3422,
 CVE-2014-3423).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3421
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3422
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3423
 http://advisories.mageia.org/MGASA-2014-0250.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 83009e4450f55eb7f93487bfab04992b  mes5/i586/emacs-22.3-2.2mdvmes5.2.i586.rpm
 d9412d95a1b028402920507d87b1e6fe  mes5/i586/emacs-common-22.3-2.2mdvmes5.2.i586.rpm
 5caded9b5a33f65fcf10d52ef60fa863  mes5/i586/emacs-doc-22.3-2.2mdvmes5.2.i586.rpm
 6073a97d86acd7050a240227476ff3bd  mes5/i586/emacs-el-22.3-2.2mdvmes5.2.i586.rpm
 8cd658a90f7ff05b66181469cc12368c  mes5/i586/emacs-gtk-22.3-2.2mdvmes5.2.i586.rpm
 55f9dfb68988f301a90cc624f5ad192a  mes5/i586/emacs-leim-22.3-2.2mdvmes5.2.i586.rpm
 090073979e73b9742fcd4a5190cb999b  mes5/i586/emacs-nox-22.3-2.2mdvmes5.2.i586.rpm 
 4234da3f31cd692e8f1fee865cddc4d9  mes5/SRPMS/emacs-22.3-2.2mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 2ba85e69b3acc83227bcfb51443fc9dd  mes5/x86_64/emacs-22.3-2.2mdvmes5.2.x86_64.rpm
 342aac6ff5ed1f26c7a22de98c9c906b  mes5/x86_64/emacs-common-22.3-2.2mdvmes5.2.x86_64.rpm
 04edd833f535f8acd69d486be333e882  mes5/x86_64/emacs-doc-22.3-2.2mdvmes5.2.x86_64.rpm
 3a10f0e8c0ae91361ceea87d420b89ec  mes5/x86_64/emacs-el-22.3-2.2mdvmes5.2.x86_64.rpm
 62e09ba4cb023e85b38b75f337e64446  mes5/x86_64/emacs-gtk-22.3-2.2mdvmes5.2.x86_64.rpm
 f9b7df8137b06eb993b66e76bdd98286  mes5/x86_64/emacs-leim-22.3-2.2mdvmes5.2.x86_64.rpm
 6247713e8fb162a4f6b6bd4e70a22586  mes5/x86_64/emacs-nox-22.3-2.2mdvmes5.2.x86_64.rpm 
 4234da3f31cd692e8f1fee865cddc4d9  mes5/SRPMS/emacs-22.3-2.2mdvmes5.2.src.rpm

 Mandriva Business Server 1/X86_64:
 b9d63442e90756239d0f654b5e486b28  mbs1/x86_64/emacs-23.3-9.2.mbs1.x86_64.rpm
 e06aef0f36b8f9378272f4a3265923f2  mbs1/x86_64/emacs-common-23.3-9.2.mbs1.x86_64.rpm
 e9496ba2853b1164c781d673dec466e4  mbs1/x86_64/emacs-doc-23.3-9.2.mbs1.x86_64.rpm
 c7d86db9f5307bd72474d842993ab457  mbs1/x86_64/emacs-el-23.3-9.2.mbs1.noarch.rpm
 9e6ee23c74741b1bcd26cd16b29c9083  mbs1/x86_64/emacs-leim-23.3-9.2.mbs1.x86_64.rpm
 93b81f7e6891d99f8fb631de60caf26c  mbs1/x86_64/emacs-nox-23.3-9.2.mbs1.x86_64.rpm 
 33ac06e008af0567e480d17e450d2db3  mbs1/SRPMS/emacs-23.3-9.2.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTlwF/mqjQ0CJFipgRAtHdAKCsDqWPr8I2BCm5LIvpsF5lGbaqBgCg3g/U
mfQWuhuIHEsEeK7UXC1AvAo=
=wRim
-----END PGP SIGNATURE-----