GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade emacs | Sep 27, 2017 | Sep 14, 2017 |
| Amazon_linux | — | Upgrade emacs | Oct 13, 2017 | Sep 14, 2017 |
| Centos_linux | — | Upgrade emacs-elUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-commonUpgrade emacs | Oct 19, 2017 | Sep 14, 2017 |
| Debian | — | Upgrade emacs23Upgrade emacs25Upgrade emacs24 | Dec 4, 2017 | Sep 14, 2017 |
| Gentoo Linux | — | Upgrade app-editors/emacs. | Jan 8, 2018 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade emacs-noxUpgrade emacs-filesystemUpgrade emacs-commonUpgrade emacs | Nov 30, 2017 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade emacs-filesystemUpgrade emacsUpgrade emacs-noxUpgrade emacs-common | Nov 30, 2017 | Sep 14, 2017 |
| Oracle Solaris | — | Upgrade editor/gnu-emacs to version 24.3-0.175.3.25.0.2.0 on Solaris 11.3 | Nov 30, 2017 | Sep 14, 2017 |
| Oracle_linux | — | Upgrade emacsUpgrade emacs-commonUpgrade emacs-filesystemUpgrade emacs-noxUpgrade emacs-elUpgrade emacs-terminal | Sep 20, 2017 | Sep 4, 2017 |
| Redhat_linux | — | Upgrade emacs-noxUpgrade emacs-elUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacsUpgrade emacs-commonUpgrade emacs-debuginfoNo solution exists | Oct 4, 2017 | Sep 14, 2017 |
| Suse | — | Upgrade emacs-noxUpgrade emacs-elUpgrade emacs-infoUpgrade emacsUpgrade etagsUpgrade emacs-x11 | Sep 25, 2017 | Sep 14, 2017 |
| Ubuntu | — | Upgrade emacs24Upgrade emacs25 | Sep 25, 2017 | Sep 14, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub