REDHAT-BUG-2345150
First published: Wed Feb 12 2025(Updated: )
A shell injection vulnerability exists in GNU Emacs due to improper handling of custom "man" URI schemes. Initially considered low severity, as it required user interaction with local files, it was later discovered that an attacker could exploit this vulnerability by tricking a user into visiting a specially crafted website or an HTTP URL with a redirect, leading to arbitrary shell command execution without further user action.This issue affects all released versions of GNU Emacs, including version 29.4. Upstream patch: <a href="https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f">https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU Emacs | <=29.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2345150?
The severity of REDHAT-BUG-2345150 is classified as low but can be escalated if exploited through user interaction.
How do I fix REDHAT-BUG-2345150?
To fix REDHAT-BUG-2345150, update GNU Emacs to the latest version that addresses the shell injection vulnerability.
What versions of GNU Emacs are affected by REDHAT-BUG-2345150?
REDHAT-BUG-2345150 affects GNU Emacs versions up to and including 29.4.
Can REDHAT-BUG-2345150 be exploited remotely?
No, REDHAT-BUG-2345150 requires user interaction, such as visiting a malicious 'man' URI scheme.
What is the impact of exploiting REDHAT-BUG-2345150?
Exploiting REDHAT-BUG-2345150 can lead to arbitrary command execution in the context of the user.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/source
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-1244
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/gnu emacs