Description
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | emacs24 | 24.5+1-11+deb9u1 | DSA-3970-1 |
| Debian 9 | emacs25 | 25.1+1-4+deb9u1 | DSA-3975-1 |
| Debian 8 | emacs24 | 24.4+1-5+deb8u1 | DSA-3970-1 |
| Debian 7 | emacs23 | 23.4+1-4+deb7u1 | DLA-1101-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | emacs24 | 24.5+1-6ubuntu1.1 | USN-3427-1 |
| Ubuntu 14.04 LTS | emacs24 | 24.3+1-2ubuntu1.1 | USN-3427-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | emacs +5 | 1:24.3-20.el7_4 | RHSA-2017:2771 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP3 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES 12 SP2 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES 12 SP1 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES 12 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES 11 SP4 | emacs | 22.3-42.3.1 | SUSE-SU-2017:2532-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP3 | emacs | 22.3-42.3.1 | SUSE-SU-2017:2532-1 |
| SLES for SAP 12 SP3 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES for SAP 12 SP2 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES for SAP 12 SP1 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SLES for SAP 11 SP4 | emacs | 22.3-42.3.1 | SUSE-SU-2017:2532-1 |
| SUSE OpenStack Cloud 6 | emacs | 24.3-25.3.1 | SUSE-SU-2017:2529-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | emacs | 22.3-42.3.1 | SUSE-SU-2017:2532-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | emacs +5 | 1:24.3-20.el7_4 | ELSA-2017-2771 |
Advisories 8
- RHSA-2017:2771 Red Hat Security Advisory: emacs security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-3970-1 emacs24 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3975-1 emacs25 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1101-1 emacs23 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3427-1 emacs24 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2017:2529-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:2532-1 Security update for emacs SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2017-2771 Important: emacs security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 19, 2017
References
- DSA-3975 vendor-advisory
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70
- DSA-3970 vendor-advisory
- GLSA-201801-07 vendor-advisory
- RHSA-2017:2771 vendor-advisory
- https://www.gnu.org/software/emacs/index.html#Releases
- http://www.openwall.com/lists/oss-security/2017/09/11/1
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350