CVE-2023-28617

Опубликовано: 19 мар. 2023

Источник: redhat

CVSS3: 7.8

EPSS Низкий

Описание

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the function org-babel-execute:latex in ob-latex.el can result in arbitrary command execution.

Меры по смягчению последствий

Do not evaluate untrusted Lisp or org-mode code.

Затронутые пакеты

Платформа	Пакет	Состояние	Рекомендация	Релиз
Red Hat Enterprise Linux 6	emacs	Not affected
Red Hat Enterprise Linux 7	emacs	Not affected
Red Hat Enterprise Linux 8	emacs	Fixed	RHSA-2023:1930	24.04.2023
Red Hat Enterprise Linux 8	emacs	Fixed	RHSA-2023:1930	24.04.2023
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions	emacs	Fixed	RHSA-2023:3189	17.05.2023
Red Hat Enterprise Linux 8.2 Advanced Update Support	emacs	Fixed	RHSA-2023:1915	20.04.2023
Red Hat Enterprise Linux 8.2 Telecommunications Update Service	emacs	Fixed	RHSA-2023:1915	20.04.2023
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	emacs	Fixed	RHSA-2023:1915	20.04.2023
Red Hat Enterprise Linux 8.4 Extended Update Support	emacs	Fixed	RHSA-2023:1958	25.04.2023
Red Hat Enterprise Linux 8.6 Extended Update Support	emacs	Fixed	RHSA-2023:1931	24.04.2023

Показывать по

Ссылки на источники

Дополнительная информация

Статус:

Important

Дефект:

CWE-77

https://bugzilla.redhat.com/show_bug.cgi?id=2180544emacs: command injection vulnerability in org-mode

EPSS

Процентиль: 8%

0.00034

Низкий

7.8 High

CVSS3

Связанные уязвимости

CVE-2023-28617

CVSS3: 7.8

ubuntu

больше 2 лет назад

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

CVE-2023-28617

CVSS3: 7.8

nvd

больше 2 лет назад

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

CVE-2023-28617

CVSS3: 7.8

msrc

больше 2 лет назад

Описание отсутствует

CVE-2023-28617

CVSS3: 7.8

debian

больше 2 лет назад

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for G ...

ROS-20250814-12

CVSS3: 7.8

redos

4 дня назад

Уязвимость emacs

EPSS

Процентиль: 8%

0.00034

Низкий

7.8 High

CVSS3