Summary
It was discovered that Emacs incorrectly handled input sanitization. An
attacker could possibly use this issue to execute arbitrary commands. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. (CVE-2022-45939)
Xi Lu discovered that Emacs incorrectly handled input sanitization. An
attacker could possibly use this issue to execute arbitrary commands. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
and Ubuntu 22.04 LTS. (CVE-2022-48337)
Xi Lu discovered that Emacs incorrectly handled input sanitization. An
attacker could possibly use this issue to execute arbitrary commands. This
issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)
Xi Lu discovered that Emacs incorrectly handled input sanitization. An
attacker could possibly use this issue to execute arbitrary commands. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. (CVE-2022-48339)
It was discovered that Emacs incorrectly handled filename sanitization. An
attacker could possibly use this issue to execute arbitrary commands. This
issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04
LTS. (CVE-2023-28617)
It was discovered that Emacs incorrectly handled certain crafted files. An
attacker could possibly use this issue to crash the program, resulting in
a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203,
CVE-2024-30204, CVE-2024-30205)
It was discovered that Emacs incorrectly handled certain crafted files. An
attacker could possibly use this issue to execute arbitrary commands.
(CVE-2024-39331)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | emacs | 1:27.1+1-3ubuntu5.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | emacs24 | 24.5+1-6ubuntu1.1+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | emacs25 | 25.2+1-6ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | emacs | 1:26.3+1-1ubuntu2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | emacs | 1:29.3+1-1ubuntu2+esm1 |
Vulnerabilities 9
-
Critical 9.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,…
-
Critical 9.8
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsaf…
-
High 7.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file,…
-
High 7.8
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-ist…
-
High 7.8
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary co…
-
High 7.3
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local com…
-
High 7.1
In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.
-
Medium 5.5
In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
-
Low 2.8
In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.
References
-
report
https://ubuntu.com/security/CVE-2022-45939
-
report
https://ubuntu.com/security/CVE-2022-48337
-
report
https://ubuntu.com/security/CVE-2022-48338
-
report
https://ubuntu.com/security/CVE-2022-48339
-
report
https://ubuntu.com/security/CVE-2023-28617
-
report
https://ubuntu.com/security/CVE-2024-30203
-
report
https://ubuntu.com/security/CVE-2024-30204
-
report
https://ubuntu.com/security/CVE-2024-30205
-
report
https://ubuntu.com/security/CVE-2024-39331
-
report
https://launchpad.net/bugs/2070418