Skip to content
OpenAdvisories
High ALAS2023-2024-663 4 CVEs

Important: emacs security update (Amazon Linux 2023)

Published Jul 18, 2024 · Updated Jul 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-39331: In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5. CVE-2024-30205: In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. CVE-2024-30204: In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. CVE-2024-30203: In Emacs before 29.3, Gnus treats inline MIME contents as trusted.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 emacs 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-common 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-common-debuginfo 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-debuginfo 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-debugsource 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-devel 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-filesystem 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-lucid 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-lucid-debuginfo 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-nox 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-nox-debuginfo 1:28.2-3.amzn2023.0.8
Amazon Linux · 2023 emacs-terminal 1:28.2-3.amzn2023.0.8

Vulnerabilities 4

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30203.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30204.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-30205.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-39331.html