SB2024091968 - Ubuntu update for emacs



SB2024091968 - Ubuntu update for emacs

Published: September 19, 2024

Security Bulletin ID SB2024091968
Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 89% Low 11%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 secuirty vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2022-45939)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing name of a source-code file in lib-src/etags.c. A remote attacker can trick the victim to use the "ctags *" command  and execute arbitrary OS commands on the target system in a situation where the current working directory has contents that depend on untrusted input.



2) OS Command Injection (CVE-ID: CVE-2022-48337)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when parsing name of a source-code file in lib-src/etags.c. A remote attacker can trick the victim use the "etags -u *" command on the directory with attacker controlled content and execute arbitrary OS commands on the target system.



3) OS Command Injection (CVE-ID: CVE-2022-48338)

The vulnerability allows a malicious gem to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the ruby-find-library-file() function. A malicious Ruby source file can execute arbitrary OS commands on the target system.



4) OS Command Injection (CVE-ID: CVE-2022-48339)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the hfy-istext-command() function when parsing the "file" and "srcdir" parameters, if a file name or directory name contains shell metacharacter. A remote attacker can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) OS Command Injection (CVE-ID: CVE-2023-28617)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the org-babel-execute:latex in ob-latex.el when processing file or directory names. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary OS commands on the target system via a file name or directory name that contains shell metacharacters.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


6) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30203)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Gnus treats inline MIME contents as trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

7) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30204)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to LaTeX preview is enabled by default for e-mail attachments. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

8) Insufficient verification of data authenticity (CVE-ID: CVE-2024-30205)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Emacs in Org mode considers contents of remote files to be trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.


9) Use of Potentially Dangerous Function (CVE-ID: CVE-2024-39331)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function. A remote attacker can execute arbitrary OS commands on the system.


Remediation

Install update from vendor's website.