emacs (1:30.1+1-6+deb13u1) trixie-security; urgency=high
* Mark esh-proc-test/kill-pipeline as unstable for now. Skip it since
it fails sporadically on at least s390x. Add
0024-Mark-esh-proc-test-kill-pipeline-as-unstable-for-now.patch to
address the issue.
* Fix an SVG-related vulnerability (CVE-2026-6861). Add
0025-src-image.c-svg_load_image-Fix-off-by-one-mistake-bu.patch which
includes the upstream patch to fix the problem. Thanks to Salvatore
Bonaccorso for reporting the issue. (Closes:
1134692)
* Don't run bytecomp-tests--dest-mountpoint where bwrap doesn't work.
Add 0026-bytecomp-tests-dest-mountpoint-only-run-test-if-bwra.patch to
address the issue. Thanks to Santiago Vila for reporting the
issue. (Closes:
1129189)
* Skip two more proced-tests in debian that are skipped on darwin to
avoid hanging during the tests. Add
0025-Skip-some-proced-tests-that-appear-to-be-hanging.patch to address
the issue.
* Mitigate a risk of executing arbitrary code when opening a file. The
vulnerability that has been mitigated could allow a specially crafted
file to trigger execution of arbitrary Emacs Lisp code immediately
upon visiting it in Emacs. The broader issue is described here:
https://debbugs.gnu.org/80574
Add 0030-Mitigate-arbitrary-code-execution-vulnerability.patch to
include the upstream patch addressing the problem. Thanks to Nicholas
D Steeves for reporting the issue.
[dgit import unpatched emacs 1:30.1+1-6+deb13u1]