Mitigate arbitrary code execution vulnerability
This mitigates a vulnerability that allowed a specially
crafted file to trigger execution of attacker-controlled
arbitrary Emacs Lisp code immediately when the file is
visited in Emacs (before the file's malicious contents are
even displayed). See demonstration in bug#80574.
* lisp/progmodes/cc-fonts.el (c-compose-keywords-list):
* lisp/vc/vc-hooks.el (vc-find-backend-function):
Nullify 'read-symbol-shorthands' around risky 'intern' calls.
Do not merge to master.
Orign: upstream, commit:
8466eb44991707d128110bdc549fad14c8e1d61e
Added-by: Rob Browning <rlb@defaultvalue.org>
Bug: https://debbugs.gnu.org/80574
README-Debian: Opening a file should have less risk of executing arbirary code
The vulnerability that has been mitigated could allow a specially
crafted file to trigger execution of attacker-controlled arbitrary
Emacs Lisp code immediately when the file is visited in Emacs. The
broader issue is described here: https://debbugs.gnu.org/80574
Gbp-Pq: Name 0026-Mitigate-arbitrary-code-execution-vulnerability.patch