Emacs 31.1 .dir-locals.el flaw can run arbitrary code
X3r0Day reported inadequate validation; the oss-security post includes only a truncated files.el diff.
Stories per day · 30 days
2 RSS
13 stories, newest first · one card per story
Stories tagged #gnu
GNU patch 2.8.1 released, fixing CVE-2026-115207
An oss-security note points to a GNU announcement, but the feed snippet gives no flaw details.
Re: Incomplete fix for Emacs CVE-2026-79992
Salvatore Bonaccorso flags CVE-2026-108976 as an incomplete fix for Emacs CVE-2026-79992.
3 Vulnerabilities in GNU Aspell before 0.60.8.3
GNU Aspell before 0.60.8.3 has three flaws, including CVE-2026-75818, per CERT Polska.
Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released
FreeIPMI 1.6.20 was announced and forwarded to oss-security without any included fix details.
Fwd: groff 1.24.2 released
groff 1.24.2 fixes recently discovered security vulnerabilities affecting all releases of the GNU text-formatting tool since 2012.
Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
Simon McVittie questions whether libextractor CVE-2026-100310 is a realistic setuid privilege escalation.
CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction
GNU Inetutils CVE-2026-95510 uses an uninitialized sigaction in rlogin, rlogind, and telnetd, risking crashes.
CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
GNU libextractor before 1.16 can be locally escalated via the LIBEXTRACTOR_PREFIX search path.
The GNU C Library security advisories update for 2026-09-17
GNU C Library advisory describes a DNS stub resolver assertion failure that aborts processes when search domains reach roughly 200 characters in glibc 2.26-2.44.
CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2
GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.
GNU security advisory (AV26-923)
Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.
Emacs arbitrary code execution: incomplete fix for CVE-2024-53920
Incomplete fix for Emacs CVE-2024-53920 allows arbitrary code execution when viewing or editing untrusted files in non-Lisp modes like Perl flymake.