Headline
Red Hat Security Advisory 2023-3481-01
Red Hat Security Advisory 2023-3481-01 - GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language, and the capability to read e-mail and news. Issues addressed include a code execution vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: emacs security update
Advisory ID: RHSA-2023:3481-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:3481
Issue date: 2023-06-06
CVE Names: CVE-2022-48339
=====================================================================
- Summary:
An update for emacs is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux Client (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode (v. 7) - noarch
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - noarch
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch
- Description:
GNU Emacs is a powerful, customizable, self-documenting text editor. It
provides special code editing features, a scripting language (elisp), and
the capability to read e-mail and news.
Security Fix(es):
- emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2171989 - CVE-2022-48339 emacs: command injection vulnerability in htmlfontify.el
- Package List:
Red Hat Enterprise Linux Client (v. 7):
Source:
emacs-24.3-23.el7_9.1.src.rpm
noarch:
emacs-filesystem-24.3-23.el7_9.1.noarch.rpm
x86_64:
emacs-24.3-23.el7_9.1.x86_64.rpm
emacs-common-24.3-23.el7_9.1.x86_64.rpm
emacs-debuginfo-24.3-23.el7_9.1.x86_64.rpm
emacs-nox-24.3-23.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Client Optional (v. 7):
noarch:
emacs-el-24.3-23.el7_9.1.noarch.rpm
emacs-terminal-24.3-23.el7_9.1.noarch.rpm
Red Hat Enterprise Linux ComputeNode (v. 7):
Source:
emacs-24.3-23.el7_9.1.src.rpm
noarch:
emacs-filesystem-24.3-23.el7_9.1.noarch.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
noarch:
emacs-el-24.3-23.el7_9.1.noarch.rpm
emacs-terminal-24.3-23.el7_9.1.noarch.rpm
x86_64:
emacs-24.3-23.el7_9.1.x86_64.rpm
emacs-common-24.3-23.el7_9.1.x86_64.rpm
emacs-debuginfo-24.3-23.el7_9.1.x86_64.rpm
emacs-nox-24.3-23.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
emacs-24.3-23.el7_9.1.src.rpm
noarch:
emacs-filesystem-24.3-23.el7_9.1.noarch.rpm
ppc64:
emacs-24.3-23.el7_9.1.ppc64.rpm
emacs-common-24.3-23.el7_9.1.ppc64.rpm
emacs-debuginfo-24.3-23.el7_9.1.ppc64.rpm
emacs-nox-24.3-23.el7_9.1.ppc64.rpm
ppc64le:
emacs-24.3-23.el7_9.1.ppc64le.rpm
emacs-common-24.3-23.el7_9.1.ppc64le.rpm
emacs-debuginfo-24.3-23.el7_9.1.ppc64le.rpm
emacs-nox-24.3-23.el7_9.1.ppc64le.rpm
s390x:
emacs-24.3-23.el7_9.1.s390x.rpm
emacs-common-24.3-23.el7_9.1.s390x.rpm
emacs-debuginfo-24.3-23.el7_9.1.s390x.rpm
emacs-nox-24.3-23.el7_9.1.s390x.rpm
x86_64:
emacs-24.3-23.el7_9.1.x86_64.rpm
emacs-common-24.3-23.el7_9.1.x86_64.rpm
emacs-debuginfo-24.3-23.el7_9.1.x86_64.rpm
emacs-nox-24.3-23.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
noarch:
emacs-el-24.3-23.el7_9.1.noarch.rpm
emacs-terminal-24.3-23.el7_9.1.noarch.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
emacs-24.3-23.el7_9.1.src.rpm
noarch:
emacs-filesystem-24.3-23.el7_9.1.noarch.rpm
x86_64:
emacs-24.3-23.el7_9.1.x86_64.rpm
emacs-common-24.3-23.el7_9.1.x86_64.rpm
emacs-debuginfo-24.3-23.el7_9.1.x86_64.rpm
emacs-nox-24.3-23.el7_9.1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
noarch:
emacs-el-24.3-23.el7_9.1.noarch.rpm
emacs-terminal-24.3-23.el7_9.1.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-48339
https://access.redhat.com/security/updates/classification/#moderate
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZH9z5tzjgjWX9erEAQh4dRAAiKIWNjgNVzpQdHCrf8gFe0/zeh8iwKOK
jRufnUymiOn1cv0Zk8Yf0F6QFAg6OFsnhI67zjb0wjXTCbtEELEk+PXj7LWOMxda
o3z2hlaz/pNqI6XANgMN6GkxUuORfqdwV4zgP3qq0s9hdptzIQEFCvXU+c9antfs
mDqWQdqZULXKRqmqZsV+FY/GoCOiXR30w4MSGd12qFCcB06MvnYcamvKwhWlXBGl
s45DdVMuv0W7IRxlj2mwd+1wDI5oSPSuH7Dj3yHsD3B51Is5Ip5fR01fXUg3K/CL
QKv7tXA5SvvEeZj1aLJld+Ja0X7ArOYcAqVUJNyRx8c3IMUe1eXRpjU38Q1G+5oa
afIWx+YtydYN/CzrgXvfxwE1pT3MLiRZVYeCY9+3qYdRN6bUwEbMDubpXyB74iCn
EJeO26l3KuS4Kz8bHxdUOXEaX+NhROeaYE8VpYiUGg86JpU4WLDTkZjth+hxRTxN
uUNYwQs+FH9YD5OgoQRNSxJSImDhxcfPdbEJQKCH8ojXjGC7rJoJZSMpMzXiPMTc
tA+n+eKkSs+cIzYl4IARX+MzhjWaMWw+VKEsSO3SeAfkNeWvN2hrHVwzYXO0BSHc
Mjmzzo/GV8gofa4SDZp+LrdJ3BUnCuwGRaKjDTIGdjuDHBIkDNoMimBTjQ3R/Ti1
ZHjYLAN9USg=
=oqzK
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Ubuntu Security Notice 7027-1 - It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
Gentoo Linux Security Advisory 202407-8 - Multiple vulnerabilities have been discovered in GNU Emacs and Org Mode, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 26.3-r16:26 are affected.
Red Hat Security Advisory 2024-1408-03 - An update for emacs is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Issues addressed include a code execution vulnerability.
Red Hat Security Advisory 2023-7083-01 - An update for emacs is now available for Red Hat Enterprise Linux 8. Issues addressed include a code execution vulnerability.
IBM QRadar SIEM 7.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 254138
Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.
Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4.13.0 on Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2020-16250: A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM ident...
An update for emacs is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-48339: A flaw was found in the Emacs package. If a file name or directory name contains shell metacharacters, arbitrary code may be executed.
Red Hat Security Advisory 2023-2626-01 - GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language, and the capability to read e-mail and news. Issues addressed include a code execution vulnerability.
An update for emacs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-48337: A flaw was found in the Emacs package. This flaw allows attackers to execute commands via shell metacharacters in the name of a source-code file. * CVE-2022-48338: A flaw was found in the Emacs package. A malicious ruby source file may cause a local command injection. * CVE-2022-48339: A flaw was found in the Emacs package. If a file name or direc...
Ubuntu Security Notice 5955-1 - It was discovered that Emacs did not properly manage certain files when using htmlfontify functionality. A local attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary commands.
Debian Linux Security Advisory 5360-1 - Xi Lu discovered that missing input sanitising in Emacs (in etags, the Ruby mode and htmlfontify) could result in the execution of arbitrary shell commands.
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.