CVE-2023-27985: OS Command Injection
Published Mar 9, 2023
·Updated
emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90
Affected Software
8 affected componentsFixes available
GNU Emacs>=28.1<=28.2
alpine/emacs>=28.1<28.2-r2
28.2-r2
alpine/emacs>=28.1<28.2-r5
28.2-r5
alpine/emacs>=28.1<28.2-r5
28.2-r5
alpine/emacs>=28.1<28.2-r5
28.2-r5
alpine/emacs>=28.1<28.2-r5
28.2-r5
alpine/emacs>=28.1<28.2-r5
28.2-r5
alpine/emacs>=28.1<28.2-r5
28.2-r5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/emacsto a version that resolves this vulnerability.Fixed in 28.2-r2 - Upgrade
Upgrade
alpine/emacsto a version that resolves this vulnerability.Fixed in 28.2-r5 - Upgrade
Upgrade
Emacsto a version that resolves this vulnerability.Fixed in 29.0.90
Event History
Mar 9, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via OSV·06:15 AM
DescriptionSeverityAffected Software