emacs-29.3

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Contains some security fixes:

* Changes in Emacs 29.3
Emacs 29.3 is an emergency bugfix release intended to fix several
security vulnerabilities described below.

** Arbitrary Lisp code is no longer evaluated as part of turning on Org mode.
This is for security reasons, to avoid evaluating malicious Lisp code.

** New buffer-local variable 'untrusted-content'.
When this is non-nil, Lisp programs should treat buffer contents with
extra caution.

** Gnus now treats inline MIME contents as untrusted.
To get back previous insecure behavior, 'untrusted-content' should be
reset to nil in the buffer.

** LaTeX preview is now by default disabled for email attachments.
To get back previous insecure behavior, set the variable
'org--latex-preview-when-risky' to a non-nil value.

** Org mode now considers contents of remote files to be untrusted.
Remote files are recognized by calling 'file-remote-p'. 

Marked as High because this is classified as an emergency by upstream

[Douglas R. Reno]

CVEs have been assigned - CVE-2024-30205, CVE-2024-30204, CVE-2024-30203, and CVE-2024-30202

[Bruce Dubbs]

Fixed at commit 37057adbd5. Leaving open for security advisory.

[Douglas R. Reno]

SA-12.1-014 issued