GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade emacs | Sep 27, 2017 | Sep 14, 2017 |
| Amazon_linux | — | Upgrade emacs | Oct 13, 2017 | Sep 14, 2017 |
| Centos_linux | — | Upgrade emacs-filesystemUpgrade emacs-terminalUpgrade emacsUpgrade emacs-commonUpgrade emacs-noxUpgrade emacs-debuginfoUpgrade emacs-el | Oct 19, 2017 | Sep 14, 2017 |
| Debian | — | Upgrade emacs24Upgrade emacs23Upgrade emacs25 | Dec 4, 2017 | Sep 14, 2017 |
| Gentoo Linux | — | Upgrade app-editors/emacs. | Jan 8, 2018 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade emacsUpgrade emacs-filesystemUpgrade emacs-commonUpgrade emacs-nox | Nov 30, 2017 | Sep 14, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade emacs-commonUpgrade emacs-filesystemUpgrade emacs-noxUpgrade emacs | Nov 30, 2017 | Sep 14, 2017 |
| Oracle Solaris | — | Upgrade editor/gnu-emacs to version 24.3-0.175.3.25.0.2.0 on Solaris 11.3 | Nov 30, 2017 | Sep 14, 2017 |
| Oracle_linux | — | Upgrade emacs-noxUpgrade emacs-elUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacsUpgrade emacs-common | Sep 20, 2017 | Sep 4, 2017 |
| Redhat_linux | — | No solution existsUpgrade emacs-commonUpgrade emacs-debuginfoUpgrade emacsUpgrade emacs-noxUpgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-el | Oct 4, 2017 | Sep 14, 2017 |
| Suse | — | Upgrade emacs-x11Upgrade etagsUpgrade emacsUpgrade emacs-infoUpgrade emacs-noxUpgrade emacs-el | Sep 25, 2017 | Sep 14, 2017 |
| Ubuntu | — | Upgrade emacs24Upgrade emacs25 | Sep 25, 2017 | Sep 14, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub