Index: vuln.xml =================================================================== RCS file: /home/pcvs/ports/security/vuxml/vuln.xml,v retrieving revision 1.2159 diff -u -r1.2159 vuln.xml --- vuln.xml 14 May 2010 18:28:43 -0000 1.2159 +++ vuln.xml 29 May 2010 12:00:30 -0000 @@ -388,66 +388,7 @@ - emacs -- movemail symlink race condition - - - movemail - 1.0 - - - emacs - 21.3_14 - 22.3_1,122.3_4,1 - 23.123.1_5,1 - - - xemacs - 21.4.22_4 - - - xemacs-devel - 21.5.b28_8,1 - - - xemacs-mule - zh-xemacs-mule - ja-xemacs-mule-canna - 21.4.21_6 - - - xemacs-devel-mule - xemacs-devel-mule-xft - 21.5.b28_10 - - - - -

Ubuntu Security Notice USN-919-1 reports:

-
-

Dan Rosenberg discovered that the email helper in Emacs - did not correctly check file permissions. A local - attacker could perform a symlink race to read or append - to another user's mailbox if it was stored under a - group-writable group-"mail" directory.

-
-

The movemail program, which provides this functionality - to Emacs, can also be installed on FreeBSD via the movemail - port. This port is therefore, in addition to Emacs, also - vulnerable to this attack.

- -
- - CVE-2010-0825 - http://secunia.com/advisories/39155 - http://www.ubuntu.com/usn/USN-919-1 - http://www.vupen.com/english/advisories/2010/0734 - http://xforce.iss.net/xforce/xfdb/57457 - https://bugs.launchpad.net/ubuntu/+bug/531569 - - - 2010-03-03 - 2010-04-22 - +