Drake Wilson has reported a vulnerability in GNU Emacs, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error in the "hack-local-variables" function where local variables within a file are processed in an insecure manner. This can be exploited to e.g. modify a user's user-init-file and execute arbitrary Emacs Lisp code when a specially crafted file is opened.

Successful exploitation requires that "enable-local-variables" is set to ":safe".

The vulnerability is reported in version 22.1. Other versions may also be affected.

Solution
Fixed in the CVS repository.
Further details available to Secunia VIM customers

Provided and/or discovered by
Drake Wilson

Original Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449008

Deep Links
Links available to Secunia VIM customers