Skip to content
OpenAdvisories
High ALAS2-2024-2608 4 CVEs

Important: emacs security update (Amazon Linux 2)

Published Aug 1, 2024 · Updated Aug 13, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-39331: In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5. CVE-2024-30205: In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. CVE-2024-30204: In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30203: In Emacs before 29.3, Gnus treats inline MIME contents as trusted.

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 emacs 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-common 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-debuginfo 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-devel 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-filesystem 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-lucid 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-nox 1:27.2-4.amzn2.0.5
Amazon Linux · 2 emacs-terminal 1:27.2-4.amzn2.0.5

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30203.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30204.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30205.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39331.html