Description
lisp/files.el in Emacs 23.2, 23.3, 23.4, and 24.1 automatically executes eval forms in local-variable sections when the enable-local-variables option is set to :safe, which allows user-assisted remote attackers to execute arbitrary Emacs Lisp code via a crafted file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | emacs23 | 23.2+1-7+squeeze1 | DSA-2603-1 |
Advisories 1
- DSA-2603-1 emacs23 - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- SSA:2012-228-02 vendor-advisory
- http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155
- openSUSE-SU-2012:1348 vendor-advisory
- 50801 third-party-advisory
- [oss-security] 20120812 Re: Security flaw in GNU Emacs file-local variables mailing-list
- USN-1586-1 vendor-advisory
- 54969 vdb-entry
- 1027375 vdb-entry
- [oss-security] 20120813 Security flaw in GNU Emacs file-local variables mailing-list
- 50157 third-party-advisory
- MDVSA-2013:076 vendor-advisory
- DSA-2603 vendor-advisory