Security update for emacs SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2015:0834-1 Final 1 1 2015-03-23T16:13:36Z current 2015-03-23T16:13:36Z 2015-03-23T16:13:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for emacs Emacs has been updated to fix the following issues: * Several cases of insecure usage of temporary files. (CVE-2014-3421, CVE-2014-3422, CVE-2014-3423, CVE-2014-3424) * Use of vc-annotate for renamed files when using Git. (bnc#854683) Security Issues: * CVE-2014-3421 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3421> * CVE-2014-3422 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3422> * CVE-2014-3423 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3423> * CVE-2014-3424 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3424> The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp3-emacs,sledsp3-emacs,slessp3-emacs Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2015/suse-su-20150834-1/ Link for SUSE-SU-2015:0834-1 https://lists.suse.com/pipermail/sle-security-updates/2015-May/001372.html E-Mail link for SUSE-SU-2015:0834-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/854683 SUSE Bug 854683 https://bugzilla.suse.com/876847 SUSE Bug 876847 https://www.suse.com/security/cve/CVE-2014-3421/ SUSE CVE CVE-2014-3421 page https://www.suse.com/security/cve/CVE-2014-3422/ SUSE CVE CVE-2014-3422 page https://www.suse.com/security/cve/CVE-2014-3423/ SUSE CVE CVE-2014-3423 page https://www.suse.com/security/cve/CVE-2014-3424/ SUSE CVE CVE-2014-3424 page SUSE Linux Enterprise Desktop 11 SP3 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server for SAP Applications 11 SP3 SUSE Linux Enterprise Software Development Kit 11 SP3 emacs-nox-22.3-4.42.1 emacs-22.3-4.42.1 emacs-info-22.3-4.42.1 emacs-x11-22.3-4.42.1 emacs-el-22.3-4.42.1 emacs-22.3-4.42.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 emacs-info-22.3-4.42.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 emacs-x11-22.3-4.42.1 as a component of SUSE Linux Enterprise Desktop 11 SP3 emacs-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3 emacs-el-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3 emacs-info-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3 emacs-nox-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3 emacs-x11-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3 emacs-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA emacs-el-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA emacs-info-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA emacs-nox-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA emacs-x11-22.3-4.42.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA emacs-22.3-4.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 emacs-el-22.3-4.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 emacs-info-22.3-4.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 emacs-nox-22.3-4.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 emacs-x11-22.3-4.42.1 as a component of SUSE Linux Enterprise Server for SAP Applications 11 SP3 emacs-nox-22.3-4.42.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP3 lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file. CVE-2014-3421 SUSE Linux Enterprise Desktop 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Software Development Kit 11 SP3:emacs-nox-22.3-4.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150834-1/ https://www.suse.com/security/cve/CVE-2014-3421.html CVE-2014-3421 https://bugzilla.suse.com/876847 SUSE Bug 876847 lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/. CVE-2014-3422 SUSE Linux Enterprise Desktop 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Software Development Kit 11 SP3:emacs-nox-22.3-4.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150834-1/ https://www.suse.com/security/cve/CVE-2014-3422.html CVE-2014-3422 https://bugzilla.suse.com/876847 SUSE Bug 876847 lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file. CVE-2014-3423 SUSE Linux Enterprise Desktop 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Software Development Kit 11 SP3:emacs-nox-22.3-4.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150834-1/ https://www.suse.com/security/cve/CVE-2014-3423.html CVE-2014-3423 https://bugzilla.suse.com/876847 SUSE Bug 876847 lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file. CVE-2014-3424 SUSE Linux Enterprise Desktop 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Desktop 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-el-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-info-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-nox-22.3-4.42.1 SUSE Linux Enterprise Server for SAP Applications 11 SP3:emacs-x11-22.3-4.42.1 SUSE Linux Enterprise Software Development Kit 11 SP3:emacs-nox-22.3-4.42.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2015/suse-su-20150834-1/ https://www.suse.com/security/cve/CVE-2014-3424.html CVE-2014-3424 https://bugzilla.suse.com/876847 SUSE Bug 876847