GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade emacs | Sep 27, 2017 | Sep 14, 2017 |
| Amazon_linux | — | Upgrade emacs | Oct 13, 2017 | Sep 14, 2017 |
| Centos_linux | — | Upgrade emacs-elUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacsUpgrade emacs-filesystemUpgrade emacs-terminalUpgrade emacs-common | Oct 19, 2017 | Sep 14, 2017 |
| Debian | — | Upgrade emacs24Upgrade emacs25Upgrade emacs23 | Dec 4, 2017 | Sep 14, 2017 |
| Gentoo Linux | — | Upgrade app-editors/emacs. | Jan 8, 2018 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade emacs-commonUpgrade emacsUpgrade emacs-filesystemUpgrade emacs-nox | Nov 30, 2017 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade emacs-filesystemUpgrade emacsUpgrade emacs-noxUpgrade emacs-common | Nov 30, 2017 | Sep 14, 2017 |
| Oracle Solaris | — | Upgrade editor/gnu-emacs to version 24.3-0.175.3.25.0.2.0 on Solaris 11.3 | Nov 30, 2017 | Sep 14, 2017 |
| Oracle_linux | — | Upgrade emacs-terminalUpgrade emacs-noxUpgrade emacs-elUpgrade emacs-commonUpgrade emacsUpgrade emacs-filesystem | Sep 20, 2017 | Sep 4, 2017 |
| Redhat_linux | — | Upgrade emacs-filesystemUpgrade emacsUpgrade emacs-elUpgrade emacs-terminalUpgrade emacs-noxNo solution existsUpgrade emacs-debuginfoUpgrade emacs-common | Oct 4, 2017 | Sep 14, 2017 |
| Suse | — | Upgrade emacs-noxUpgrade emacsUpgrade emacs-elUpgrade emacs-infoUpgrade emacs-x11Upgrade etags | Sep 25, 2017 | Sep 14, 2017 |
| Ubuntu | — | Upgrade emacs24Upgrade emacs25 | Sep 25, 2017 | Sep 14, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub