Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-45939: GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | emacs | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-common | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-debuginfo | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-devel | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-filesystem | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-lucid | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-nox | 1:27.2-4.amzn2.0.2 |
| Amazon Linux · 2 | emacs-terminal | 1:27.2-4.amzn2.0.2 |
Vulnerabilities 1
-
High 7.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2022-45939.html