Описание
Security update for emacs
This update for emacs fixes the following issues:
- code execution upon opening arbitrary file (bsc#1275941).
- CVE-2026-77219: memory leak via the PBM/PPM/PGM image loader (bsc#1276264).
- CVE-2026-79992: zero-click local command execution via TRAMP (bsc#1275927).
Список пакетов
SUSE Linux Enterprise Server 12 SP5-LTSS
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5
Ссылки
- Link for SUSE-SU-2026:3993-1
- E-Mail link for SUSE-SU-2026:3993-1
- SUSE Security Ratings
- SUSE Bug 1275927
- SUSE Bug 1275941
- SUSE Bug 1276264
- SUSE CVE CVE-2026-77219 page
- SUSE CVE CVE-2026-79992 page
Описание
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
Затронутые продукты
Ссылки
- CVE-2026-77219
- SUSE Bug 1276264
Описание
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.
Затронутые продукты
Ссылки
- CVE-2026-79992
- SUSE Bug 1275927