-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] emacs movemail POP utility (SSA:2005-201-02)


New emacs packages are available for Slackware 10.1 and -current to
a security issue with the movemail utility for retrieving mail from
a POP mail server.  If used to connect to a malicious POP server, it
is possible for the server to cause the execution of arbitrary code as
the user running emacs.

Here are the details from the Slackware 10.1 ChangeLog:
+--------------------------+
patches/packages/emacs-21.4a-i486-1.tgz:  Upgraded to emacs-21.4a.
  This fixes a vulnerability in the movemail utility when connecting to a
  malicious POP server that may allow the execution of arbitrary code as
  the user running emacs.
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-21.4a-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-info-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-leim-21.4-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-lisp-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-misc-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/emacs-nox-21.4a-i486-1.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-21.4a-i486-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-info-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-leim-21.4-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-lisp-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-misc-21.4a-noarch-1.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/e/emacs-nox-21.4a-i486-1.tgz


MD5 signatures:
+-------------+

Slackware 10.1 packages:
7bb30482651e5e4558eea0b66b55d1de  emacs-21.4a-i486-1.tgz
45b0fb651c6c7b9deacb55efe582b4b5  emacs-info-21.4a-noarch-1.tgz
5d0152fa95027215b14ece0f8fbf8a37  emacs-leim-21.4-noarch-1.tgz
5bd976633a33dad36161eba7e92bec61  emacs-lisp-21.4a-noarch-1.tgz
2763fe68ed8c833ed95ec4c95aacc562  emacs-misc-21.4a-noarch-1.tgz
195df428e1a10c50da88129002c9e2f9  emacs-nox-21.4a-i486-1.tgz

Slackware -current packages:
44986e6ca1e02d971f43e3d0f118dde3  emacs-21.4a-i486-1.tgz
100643203d73d54df78c58eef8596e4b  emacs-info-21.4a-noarch-1.tgz
70effd3b113d795d8532022139269f77  emacs-leim-21.4-noarch-1.tgz
2bcec4297285f30124e2a61f85a27440  emacs-lisp-21.4a-noarch-1.tgz
48ebc0d4e581d5deb15159a4d34c060d  emacs-misc-21.4a-noarch-1.tgz
04fb5ed4b1da572063b2a991d8c54edf  emacs-nox-21.4a-i486-1.tgz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg emacs-21.4a-i486-1.tgz emacs-info-21.4a-noarch-1.tgz emacs-leim-21.4-noarch-1.tgz emacs-lisp-21.4a-noarch-1.tgz emacs-misc-21.4a-noarch-1.tgz emacs-nox-21.4a-i486-1.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFC3qbFakRjwEAQIjMRAgthAJsFFB9Z36TqtkNPM+tegL9KZS1zogCdHHcS
9X8hl9NzM70t4pPBPymgqe0=
=cd3U
-----END PGP SIGNATURE-----