XEmacs "fast-lock-mode" File Processing Vulnerability - Advisories

XEmacs "fast-lock-mode" File Processing Vulnerability

Secunia Advisory:	SA30216
Release Date:	2008-05-13

Critical:	Moderately critical
Impact:	System access
Where:	From remote
Solution Status:	Unpatched

Software:	XEmacs 21.x

CVE reference:	CVE-2008-2142 (Secunia mirror)

	This advisory is currently marked as unpatched! - Companies can be alerted when a patch is released!

Description: A vulnerability has been reported in XEmacs, which can be exploited by malicious people to compromise a user's system. For more information: SA30199 The vulnerability is reported in 21.4 and 21.5. Other versions may also be affected. Solution: Do not use "fast-lock-mode" as "font-lock-support-mode". Do not open files within untrusted directories. Provided and/or discovered by: Reported in GNU Emacs by Morten Welinder. Original Advisory: http://lists.gnu.org/archive/html/emacs-devel/2008-05/msg00645.html http://tracker.xemacs.org/XEmacs/its/issue378 Other References: SA30199: http://secunia.com/advisories/30199/



Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

2 Related Secunia Security Advisories

1. XEmacs vcdiff Insecure Temporary Files

Send Feedback to Secunia

If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.

Secunia PSI
Scan | Patch | Track
Free Download

Secunia Poll

Most Popular Advisories

1.	Microsoft Windows DNS Spoofing Vulnerabilities

2.	Microsoft Access Snapshot Viewer ActiveX Control Vulnerability

3.	Microsoft Windows Explorer Saved Search Vulnerability

4.	Joomla Unauthorized Access Vulnerabilities

5.	Microsoft SQL Server and MSDE Multiple Vulnerabilities

6.	ArticleBeach Script "page" File Inclusion Vulnerability

7.	Microsoft Outlook Web Access Script Insertion Vulnerabilities

8.	Symantec Brightmail AntiSpam Notifier Denial of Service

9.	Mozilla Firefox Multiple Vulnerabilities

10.	PHP-Nuke 4ndvddb Module "id" SQL Injection Vulnerability