Fix for CVE-2008-2142, automatically loading and executing .flc files.

1 files changed, 32 insertions, 0 deletions

diff --git a/editors/emacs/patches/patch-aw b/editors/emacs/patches/patch-aw
new file mode 100644
index 00000000000..0550b65ec19
--- /dev/null
+++ b/editors/emacs/patches/patch-aw
@@ -0,0 +1,32 @@
+$NetBSD: patch-aw,v 1.4 2008/06/02 21:09:48 markd Exp $
+
+fix for CVE-2008-2142 from post 22.2 cvs.
+
+--- lisp/obsolete/fast-lock.el.orig	2007-01-21 16:53:09.000000000 +1300
++++ lisp/obsolete/fast-lock.el
+@@ -286,7 +286,7 @@ for buffers in Rmail mode, and size is i
+ 				      (integer :tag "size")))))
+   :group 'fast-lock)
+ 
+-(defcustom fast-lock-cache-directories '("." "~/.emacs-flc")
++(defcustom fast-lock-cache-directories '("~/.emacs-flc")
+ ; - `internal', keep each file's Font Lock cache file in the same file.
+ ; - `external', keep each file's Font Lock cache file in the same directory.
+   "*Directories in which Font Lock cache files are saved and read.
+@@ -304,12 +304,15 @@ For example:
+  ((\"^/your/true/home/directory/\" . \".\") \"~/.emacs-flc\")
+ 
+ would cause a file's current directory to be used if the file is under your
+-home directory hierarchy, or otherwise the absolute directory `~/.emacs-flc'."
++home directory hierarchy, or otherwise the absolute directory `~/.emacs-flc'.
++For security reasons, it is not advisable to use the file's current directory
++to avoid the possibility of using the cache of another user."
+   :type '(repeat (radio (directory :tag "directory")
+ 			(cons :tag "Matching"
+ 			      (regexp :tag "regexp")
+ 			      (directory :tag "directory"))))
+   :group 'fast-lock)
++(put 'fast-lock-cache-directories 'risky-local-variable t)
+ 
+ (defcustom fast-lock-save-events '(kill-buffer kill-emacs)
+   "*Events under which caches will be saved.