SB2024070104 - Gentoo update for GNU Emacs, Org Mode

Description

This security bulletin contains information about 7 secuirty vulnerabilities.

1) OS Command Injection (CVE-ID: CVE-2022-48337)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when parsing name of a source-code file in lib-src/etags.c. A remote attacker can trick the victim use the "etags -u *" command on the directory with attacker controlled content and execute arbitrary OS commands on the target system.

2) OS Command Injection (CVE-ID: CVE-2022-48338)

The vulnerability allows a malicious gem to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the ruby-find-library-file() function. A malicious Ruby source file can execute arbitrary OS commands on the target system.

3) OS Command Injection (CVE-ID: CVE-2022-48339)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the hfy-istext-command() function when parsing the "file" and "srcdir" parameters, if a file name or directory name contains shell metacharacter. A remote attacker can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Use of Potentially Dangerous Function (CVE-ID: CVE-2024-30202)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to usage of dangerous method when processing untrusted files. A remote attacker can trick the victim to open a specially crafted document and execute arbitrary Lisp code as part of turning on Org mode.

5) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30203)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Gnus treats inline MIME contents as trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

6) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30204)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to LaTeX preview is enabled by default for e-mail attachments. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

7) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30205)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Emacs in Org mode considers contents of remote files to be trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/glsa/202407-08