Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability
From: David Engster <deng () randomsample de>
Date: Wed, 11 Jan 2012 18:32:22 +0100

Chong Yidong writes:
Kurt Seifried <kseifried () redhat com> writes:

I'll assign this a CVE once I have determined the code base status (are
these considered the same codebase, or have they forked enough to be
considered separate code bases? Also I need to ensure this hasn't
already been assigned a CVE. CC'ing relevant developers as well.

No, this hasn't already been assigned a CVE.  The upstream CEDET 1.0 is
largely the same codebase as the CEDET distributed in Emacs.  The
version in Emacs omits some CEDET components, and added some plumbing to
integrate CEDET into the Emacs build system.  But the main part of the
Emacs Lisp code, including the part affected by this flaw, is the same.

David, could you write up a version of the fix that applies to the CEDET
1.0 tarball?  I think distributors who package CEDET will want it.

A patch for cedet-1.0 was posted here:

http://sourceforge.net/mailarchive/forum.php?thread_name=87lipg3dw5.fsf%40engster.org&forum_name=cedet-devel

In the meantime, Eric published a bugfix-release cedet-1.0.1, so
distributors should upgrade to that.

-David


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]