Skip to content
OpenAdvisories
High ALAS2023-2023-134 2 CVEs

Important: emacs security update (Amazon Linux 2023)

Published Mar 20, 2023 · Updated Mar 22, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-27986: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped double-quote characters. CVE-2023-27985: emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 emacs 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-common 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-common-debuginfo 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-debuginfo 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-debugsource 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-devel 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-filesystem 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-lucid 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-lucid-debuginfo 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-nox 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-nox-debuginfo 1:28.2-3.amzn2023.0.4
Amazon Linux · 2023 emacs-terminal 1:28.2-3.amzn2023.0.4

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-27985.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-27986.html