First published: Mon Feb 20 2023(Updated: )
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
GNU Emacs | <=28.2 | |
IBM QRadar SIEM | <=7.5.0 - 7.5.0 UP6 | |
debian/emacs | 1:27.1+1-3.1+deb11u5 1:28.2+1-15+deb12u3 1:29.4+1-3 |
https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=1b4dc4691c1f87fc970fbe568b43869a15ad0d4c
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-48339 is a vulnerability discovered in GNU Emacs through version 28.2, involving a command injection vulnerability in htmlfontify.el.
The severity of CVE-2022-48339 is high, with a severity value of 7.8.
CVE-2022-48339 affects GNU Emacs versions up to 28.2 and can be exploited through the htmlfontify.el package.
To fix CVE-2022-48339 in GNU Emacs, it is recommended to update to a patched version of GNU Emacs, such as version 28.3 or later when available.
You can find more information about CVE-2022-48339 on the GNU Emacs commit page and the Debian and Fedora security advisories linked in the references section.