GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
CVSS Details
- CVSS 3.0 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade emacs | Sep 27, 2017 | Sep 14, 2017 |
| Amazon_linux | — | Upgrade emacs | Oct 13, 2017 | Sep 14, 2017 |
| Centos_linux | — | Upgrade emacs-elUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacs-terminalUpgrade emacsUpgrade emacs-filesystemUpgrade emacs-common | Oct 19, 2017 | Sep 14, 2017 |
| Debian | — | Upgrade emacs24Upgrade emacs23Upgrade emacs25 | Dec 4, 2017 | Sep 14, 2017 |
| Gentoo Linux | — | Upgrade app-editors/emacs. | Jan 8, 2018 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade emacs-noxUpgrade emacs-filesystemUpgrade emacsUpgrade emacs-common | Nov 30, 2017 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade emacs-commonUpgrade emacsUpgrade emacs-noxUpgrade emacs-filesystem | Nov 30, 2017 | Sep 14, 2017 |
| Oracle Solaris | — | Upgrade editor/gnu-emacs to version 24.3-0.175.3.25.0.2.0 on Solaris 11.3 | Nov 30, 2017 | Sep 14, 2017 |
| Oracle_linux | — | Upgrade emacs-noxUpgrade emacs-terminalUpgrade emacs-elUpgrade emacs-filesystemUpgrade emacs-commonUpgrade emacs | Sep 20, 2017 | Sep 4, 2017 |
| Redhat_linux | — | No solution existsUpgrade emacs-debuginfoUpgrade emacs-commonUpgrade emacsUpgrade emacs-elUpgrade emacs-noxUpgrade emacs-filesystemUpgrade emacs-terminal | Oct 4, 2017 | Sep 14, 2017 |
| Suse | — | Upgrade etagsUpgrade emacs-x11Upgrade emacs-elUpgrade emacsUpgrade emacs-infoUpgrade emacs-nox | Sep 25, 2017 | Sep 14, 2017 |
| Ubuntu | — | Upgrade emacs24Upgrade emacs25 | Sep 25, 2017 | Sep 14, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub