REDHAT-BUG-2345150: High severity gnu emacs vulnerability
A shell injection vulnerability exists in GNU Emacs due to improper handling of custom "man" URI schemes. Initially considered low severity, as it required user interaction with local files, it was later discovered that an attacker could exploit this vulnerability by tricking a user into visiting a specially crafted website or an HTTP URL with a redirect, leading to arbitrary shell command execution without further user action.This issue affects all released versions of GNU Emacs, including version 29.4.
Upstream patch: https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=820f0793f0b46448928905552726c1f1b999062f
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2345150?
The severity of REDHAT-BUG-2345150 is classified as low but can be escalated if exploited through user interaction.
How do I fix REDHAT-BUG-2345150?
To fix REDHAT-BUG-2345150, update GNU Emacs to the latest version that addresses the shell injection vulnerability.
What versions of GNU Emacs are affected by REDHAT-BUG-2345150?
REDHAT-BUG-2345150 affects GNU Emacs versions up to and including 29.4.
Can REDHAT-BUG-2345150 be exploited remotely?
No, REDHAT-BUG-2345150 requires user interaction, such as visiting a malicious 'man' URI scheme.
What is the impact of exploiting REDHAT-BUG-2345150?
Exploiting REDHAT-BUG-2345150 can lead to arbitrary command execution in the context of the user.