DSA-5360: -1 emacs -- security update
Published Feb 23, 2023
·Updated
emacs - security update
Other sources
Xi Lu discovered that missing input sanitising in Emacs (in etags, the Ruby mode and htmlfontify) could result in the execution of arbitrary shell commands.
Affected Software
2 affected components
debian/emacs
debian/emacs
Event History
Feb 23, 2023
Advisory Published
12:00 AM
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
What attacker-controlled content could trigger command execution?
The affected input-handling paths are etags, Ruby mode, and htmlfontify. An attacker would need to cause Emacs to process input through one of those components.
2
What level of impact is described?
Successful exploitation could result in execution of arbitrary shell commands, so the commands would run in the security context of the user running Emacs.