Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-1244: A flaw was found in the Emacs text editor. Improper handling of custom "man" URI schemes allows attackers to execute arbitrary shell commands by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | emacs | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-common | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-common-debuginfo | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-debuginfo | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-debugsource | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-devel | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-filesystem | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-lucid | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-lucid-debuginfo | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-nox | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-nox-debuginfo | 1:28.2-3.amzn2023.0.10 |
| Amazon Linux · 2023 | emacs-terminal | 1:28.2-3.amzn2023.0.10 |
Vulnerabilities 1
-
High 8.8
Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-1244.html