Summary
[1:27.2-18.el9_8.2]
- Fix integer overflow in pbm_load image validation (RHEL-248067)
[1:27.2-18.el9_8.1]
- Restrict Tramp user name to fix CVE-2026-79992 (RHEL-248552)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | emacs | 1:27.2-18.el9_8.2 |
| Oracle Linux · 9 | emacs-common | 1:27.2-18.el9_8.2 |
| Oracle Linux · 9 | emacs-filesystem | 1:27.2-18.el9_8.2 |
| Oracle Linux · 9 | emacs-lucid | 1:27.2-18.el9_8.2 |
| Oracle Linux · 9 | emacs-nox | 1:27.2-18.el9_8.2 |
Vulnerabilities 2
-
High 7.8
Emacs: emacs: command injection via crafted filenames in tramp
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Success…
-
High 7.1
GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader
GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image di…