Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-53920: In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs if a user chooses to enable on-the-fly diagnosis that byte compiles untrusted Emacs Lisp source code.)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | emacs | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-common | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-debuginfo | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-devel | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-filesystem | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-lucid | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-nox | 1:27.2-4.amzn2.0.6 |
| Amazon Linux · 2 | emacs-terminal | 1:27.2-4.amzn2.0.6 |
Vulnerabilities 1
-
High 7.8
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion)…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2024-53920.html