GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade emacs-filesystemUpgrade emacs-terminalUpgrade emacsUpgrade emacs-lucidUpgrade emacs-commonUpgrade emacs-nox | May 15, 2023 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade emacs | Aug 22, 2024 | Nov 28, 2022 |
| Amazon Linux Ami 2 | — | Upgrade emacs-debuginfoUpgrade emacs-terminalUpgrade emacs-noxUpgrade emacsUpgrade emacs-lucidUpgrade emacs-commonUpgrade emacs-filesystemUpgrade emacs-devel | Feb 7, 2023 | Nov 28, 2022 |
| Amazon_linux | — | Upgrade emacs | Apr 6, 2023 | Nov 28, 2022 |
| Amazon_linux_2023 | — | Upgrade emacs-debugsourceUpgrade emacs-commonUpgrade emacs-develUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacs-filesystemUpgrade emacs-common-debuginfoUpgrade emacs-lucidUpgrade emacs-terminalUpgrade emacs-lucid-debuginfoUpgrade emacsUpgrade emacs-nox-debuginfo | Feb 17, 2025 | Nov 27, 2022 |
| Centos_linux | — | Upgrade emacs-filesystemUpgrade emacs-commonUpgrade emacsUpgrade emacs-common-debuginfoUpgrade emacs-nox-debuginfoUpgrade emacs-debugsourceUpgrade emacs-lucid-debuginfoUpgrade emacs-debuginfoUpgrade emacs-noxUpgrade emacs-lucidUpgrade emacs-terminal | May 15, 2023 | Nov 28, 2022 |
| Debian | — | Upgrade emacsUpgrade xemacs21 | Jan 4, 2023 | Nov 28, 2022 |
| Freebsd | — | Upgrade emacs-noxUpgrade emacs-cannaUpgrade emacs-develUpgrade emacs-devel-noxUpgrade emacs | Jan 14, 2023 | Jan 12, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade emacs-filesystem | Feb 13, 2023 | Nov 28, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade emacs-filesystem | Mar 24, 2023 | Nov 28, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade emacs-commonUpgrade emacs-noxUpgrade emacs-filesystem | Apr 13, 2023 | Nov 28, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade emacs-filesystem | Mar 9, 2023 | Nov 28, 2022 |
| Oracle_linux | — | Upgrade emacs-terminalUpgrade emacs-filesystemUpgrade emacs-commonUpgrade emacs-noxUpgrade emacsUpgrade emacs-lucid | May 17, 2023 | Nov 27, 2022 |
| Redhat_linux | — | Upgrade emacs-filesystemUpgrade emacs-common-debuginfoUpgrade emacs-terminalUpgrade emacsUpgrade emacs-noxUpgrade emacs-debuginfoUpgrade emacs-lucidUpgrade emacs-nox-debuginfoUpgrade emacs-lucid-debuginfoNo solution existsUpgrade emacs-commonUpgrade emacs-debugsource | May 15, 2023 | Nov 28, 2022 |
| Suse | — | Upgrade emacs-elUpgrade emacs-infoUpgrade emacs-noxUpgrade emacsUpgrade emacs-x11Upgrade etags | Dec 2, 2022 | Nov 28, 2022 |
| Ubuntu | — | Upgrade emacsUpgrade emacs24-el (Ubuntu Pro)Upgrade emacs-common (Ubuntu Pro)Upgrade emacs-bin-commonUpgrade emacs24-common (Ubuntu Pro)Upgrade emacs25-common (Ubuntu Pro)Upgrade emacs25-el (Ubuntu Pro)Upgrade emacs25 (Ubuntu Pro)Upgrade emacs-elUpgrade emacs25-bin-common (Ubuntu Pro)Upgrade emacs (Ubuntu Pro)Upgrade emacs-bin-common (Ubuntu Pro)Upgrade emacs24-bin-common (Ubuntu Pro)Upgrade emacs-commonUpgrade emacs24 (Ubuntu Pro)Upgrade emacs-el (Ubuntu Pro) | Dec 15, 2022 | Nov 28, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 28, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub