rpm package
almalinux/emacs
pkg:rpm/almalinux/emacs
Vulnerabilities (11)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2025-1244 | Hig | 8.8 | < 1:27.2-11.el9_5.1 | 1:27.2-11.el9_5.1 | Feb 12, 2025 | A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a re | |
| CVE-2024-53920 | — | < 1:26.1-15.el8_10 | 1:26.1-15.el8_10 | Nov 27, 2024 | In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs | ||
| CVE-2024-39331 | — | < 1:27.2-10.el9_4 | 1:27.2-10.el9_4 | Jun 23, 2024 | In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5. | ||
| CVE-2024-30205 | — | < 1:26.1-12.el8_10 | 1:26.1-12.el8_10 | Mar 25, 2024 | In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. | ||
| CVE-2024-30203 | — | < 1:26.1-12.el8_10 | 1:26.1-12.el8_10 | Mar 25, 2024 | In Emacs before 29.3, Gnus treats inline MIME contents as trusted. | ||
| CVE-2023-2491 | — | < 1:27.2-8.el9_2.1 | 1:27.2-8.el9_2.1 | May 17, 2023 | A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in R | ||
| CVE-2023-28617 | — | < 1:26.1-7.el8_7.1 | 1:26.1-7.el8_7.1 | Mar 19, 2023 | org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. | ||
| CVE-2022-48339 | — | < 1:27.2-8.el9_2.1 | 1:27.2-8.el9_2.1 | Feb 20, 2023 | An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains | ||
| CVE-2022-48338 | — | < 1:27.2-8.el9_2.1 | 1:27.2-8.el9_2.1 | Feb 20, 2023 | An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem | ||
| CVE-2022-48337 | — | < 1:27.2-8.el9_2.1 | 1:27.2-8.el9_2.1 | Feb 20, 2023 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (s | ||
| CVE-2022-45939 | — | < 1:27.2-8.el9 | 1:27.2-8.el9 | Nov 28, 2022 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (sugg |
- affected < 1:27.2-11.el9_5.1fixed 1:27.2-11.el9_5.1
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a re
- CVE-2024-53920Nov 27, 2024affected < 1:26.1-15.el8_10fixed 1:26.1-15.el8_10
In elisp-mode.el in GNU Emacs before 30.1, a user who chooses to invoke elisp-completion-at-point (for code completion) on untrusted Emacs Lisp source code can trigger unsafe Lisp macro expansion that allows attackers to execute arbitrary code. (This unsafe expansion also occurs
- CVE-2024-39331Jun 23, 2024affected < 1:27.2-10.el9_4fixed 1:27.2-10.el9_4
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
- CVE-2024-30205Mar 25, 2024affected < 1:26.1-12.el8_10fixed 1:26.1-12.el8_10
In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.
- CVE-2024-30203Mar 25, 2024affected < 1:26.1-12.el8_10fixed 1:26.1-12.el8_10
In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
- CVE-2023-2491May 17, 2023affected < 1:27.2-8.el9_2.1fixed 1:27.2-8.el9_2.1
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in R
- CVE-2023-28617Mar 19, 2023affected < 1:26.1-7.el8_7.1fixed 1:26.1-7.el8_7.1
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.
- CVE-2022-48339Feb 20, 2023affected < 1:27.2-8.el9_2.1fixed 1:27.2-8.el9_2.1
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains
- CVE-2022-48338Feb 20, 2023affected < 1:27.2-8.el9_2.1fixed 1:27.2-8.el9_2.1
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem
- CVE-2022-48337Feb 20, 2023affected < 1:27.2-8.el9_2.1fixed 1:27.2-8.el9_2.1
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (s
- CVE-2022-45939Nov 28, 2022affected < 1:27.2-8.el9fixed 1:27.2-8.el9
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (sugg