Affected: AlmaLinux:9: emacs, AlmaLinux:9: emacs-common, AlmaLinux:9: emacs-filesystem, AlmaLinux:9: emacs-lucid, AlmaLinux:9: emacs-nox

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

* emacs: Regression of CVE-2023-28617 fixes in the AlmaLinux (CVE-2023-2491) * emacs: command execution via shell metacharacters (CVE-2022-48337) * emacs: local command injection in ruby-mode.el (CVE-2022-48338) * emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.

Affected: openEuler:20.03-LTS-SP1: emacs, openEuler:20.03-LTS-SP3: emacs, openEuler:22.03-LTS: emacs, openEuler:22.03-LTS-SP1: emacs

Emacs is the extensible, customizable, self-documenting real-time display editor.At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing,including a project planner, mail and news reader, debugger interface, calendar, and more. Security Fix(es): An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.(CVE-2022-48339) An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.(CVE-2022-48338) GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in…

emacs-28.2-2.1 on GA media

emacs: ctags local command execution vulnerability emacs: command execution via shell metacharacters emacs: command injection vulnerability in htmlfontify.el

Affected: Rocky Linux:8: emacs

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

* emacs: command execution via shell metacharacters (CVE-2022-48337)

* emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Security update for emacs

Affected: Ubuntu:16.04:LTS: xemacs21, Ubuntu:16.04:LTS: xemacs21-packages, Ubuntu:Pro:16.04:LTS: emacs24, Ubuntu:Pro:18.04:LTS: emacs25, Ubuntu:18.04:LTS: xemacs21, Ubuntu:18.04:LTS: xemacs21-packages, Ubuntu:Pro:20.04:LTS: emacs, Ubuntu:20.04:LTS: xemacs21, Ubuntu:20.04:LTS: xemacs21-packages, Ubuntu:22.04:LTS: emacs and 8 more

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.

Ein lokaler Angreifer kann mehrere Schwachstellen in GNU Emacs ausnutzen, um beliebigen Programmcode auszuführen.