A vulnerability has been discovered in GNU Emacs allowing arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 27.2-r4:27, < 28.2-r22:28, < 29.4-r10:29, < 30.2-r6:30 | >= 27.2-r4:27, >= 28.2-r22:28, >= 29.4-r10:29, >= 30.2-r6:30 |
GNU Emacs is the extensible, customizable, self-documenting real-time display editor.
A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details.
An attacker could achieve arbitrary code execution by tricking a user into opening a file or directory with a malicious filename via TRAMP.
There is no known workaround at this time.
All GNU Emacs 27 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-27.2-r4:27"
All GNU Emacs 28 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r22:28"
All GNU Emacs 29 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.4-r10:29"
All GNU Emacs 30 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-30.2-r6:30"
A vulnerability has been discovered in GNU Emacs which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 28.2-r21:28, < 29.4-r9:29, < 30.2-r5:30 | >= 28.2-r21:28, >= 29.4-r9:29, >= 30.2-r5:30, < 28 |
GNU Emacs is the extensible, customizable, self-documenting real-time display editor.
A vulnerability has been discovered in GNU Emacs. Please review the CVE identifier referenced below for details.
An attacker could achieve arbitrary code execution by tricking a user into opening a file with malicious content. No other action by the user is required.
Avoid opening any untrusted files.
All GNU Emacs 28 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r21:28"
All GNU Emacs 29 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.4-r9:29"
All GNU Emacs 30 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-30.2-r5:30"
Multiple vulnerabilities have been discovered in GNU Emacs, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 29.4-r2:29, < 28.2-r16:28, < 27.2-r20:27, < 26.3-r22:26 | >= 29.4-r2:29, >= 28.2-r16:28, >= 27.2-r20:27, >= 26.3-r22:26 |
GNU Emacs is the extensible, customizable, self-documenting real-time display editor.
Multiple vulnerabilities have been discovered in GNU Emacs. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.4-r2:29" # emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r16:28" # emerge --ask --oneshot --verbose ">=app-editors/emacs-27.2-r20:27" # emerge --ask --oneshot --verbose ">=app-editors/emacs-26.3-r22:26"
A vulnerability has been found in GNU Emacs and org-mode which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 26.3-r19:26, < 27.2-r17:27, < 28.2-r13:28, < 29.3-r3:29 | >= 26.3-r19:26, >= 27.2-r17:27, >= 28.2-r13:28, >= 29.3-r3:29 |
| app-emacs/org-mode | * | < 9.7.5 | >= 9.7.5 |
GNU Emacs is the extensible, customizable, self-documenting real-time display editor. org-mode is an Emacs mode for notes and project planning.
%(...) link abbreviations could specify unsafe functions.
Opening a malicious org-mode file could result in arbitrary code execution.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version according to the installed slot, one of:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-26.3-r19:26"
Alternatively:
# emerge --ask --oneshot --verbose ">=app-editors/emacs-27.2-r17:27"
# emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r13:28"
# emerge --ask --oneshot --verbose ">=app-editors/emacs-29.3-r3:29"
All org-mode users should upgrade to the latest package:
# emerge --ask --oneshot --verbose ">=app-emacs/org-mode-9.7.5"
Multiple vulnerabilities have been discovered in GNU Emacs and Org Mode, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 26.3-r16:26, < 27.2-r14:27, < 28.2-r10:28, < 29.2-r1:29 | >= 26.3-r16:26, >= 27.2-r14:27, >= 28.2-r10:28, >= 29.2-r1:29 |
| app-emacs/org-mode | * | < 9.6.23 | >= 9.6.23 |
GNU Emacs is a highly extensible and customizable text editor.
Multiple vulnerabilities have been discovered in GNU Emacs. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.3-r2"
All Org Mode users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emacs/org-mode-9.6.23"
A vulnerability has been found in Emacs which may allow for arbitrary command execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 23.4-r16:23, < 24.5-r4:24, < 25.2-r1:25 | >= 23.4-r16:23, >= 24.5-r4:24, >= 25.2-r1:25 |
GNU Emacs is a highly extensible and customizable text editor.
A command injection flaw within the Emacs “enriched mode” handling has been discovered.
A remote attacker, by enticing a user to open a specially crafted file, could execute arbitrary commands with the privileges of process.
There is no known workaround at this time.
All GNU Emacs 23.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-23.4-r16:23"
All GNU Emacs 24.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-24.5-r4:24"
All GNU Emacs 25.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-25.2-r1:25"
Two vulnerabilities have been found in GNU Emacs, possibly leading to user-assisted execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 24.1-r1 | >= 24.1-r1, >= 23.4-r4 (revision), < 23.2 |
GNU Emacs is a highly extensible and customizable text editor.
Multiple vulnerabilities have been discovered in GNU Emacs:
A remote attacker could entice a user to open a specially crafted file, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All GNU Emacs 24.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-24.1-r1"
All GNU Emacs 23.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-23.4-r4"
Two vulnerabilities were found in GNU Emacs, possibly leading to user-assisted execution of arbitrary code. One also affects edit-utils in XEmacs.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 22.2-r3 | >= 22.2-r3, >= 21.4-r17 (revision), < 19 |
| app-xemacs/edit-utils | * | < 2.39 | >= 2.39 |
GNU Emacs and XEmacs are highly extensible and customizable text editors. edit-utils are miscellaneous extensions to XEmacs.
Morten Welinder reports about GNU Emacs and edit-utils in XEmacs: By shipping a .flc accompanying a source file (.c for example) and setting font-lock-support-mode to fast-lock-mode in the source file through local variables, any Lisp code in the .flc file is executed without warning (CVE-2008-2142).
Romain Francoise reported a security risk in a feature of GNU Emacs related to interacting with Python. The vulnerability arises because Python, by default, prepends the current directory to the module search path, allowing for arbitrary code execution when launched from a specially crafted directory (CVE-2008-3949).
Remote attackers could entice a user to open a specially crafted file in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp code or arbitrary Python code with the privileges of the user running GNU Emacs or XEmacs.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-22.2-r3"
All edit-utils users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-xemacs/edit-utils-2.39"
Two vulnerabilities were found in GNU Emacs possibly leading to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 22.1-r3 | >= 22.1-r3, >= 21.4-r14 (revision), < 19 |
GNU Emacs is a highly extensible and customizable text editor.
Drake Wilson reported that the hack-local-variables() function in GNU Emacs 22 does not properly match assignments of local variables in a file against a list of unsafe or risky variables, allowing to override them (CVE-2007-5795). Andreas Schwab (SUSE) discovered a stack-based buffer overflow in the format function when handling values with high precision (CVE-2007-6109).
Remote attackers could entice a user to open a specially crafted file in GNU Emacs, possibly leading to the execution of arbitrary Emacs Lisp code (via CVE-2007-5795) or arbitrary code (via CVE-2007-6109) with the privileges of the user running GNU Emacs.
The first vulnerability can be worked around by setting the "enable-local-variables" option to "nil", disabling the processing of local variable lists. GNU Emacs prior to version 22 is not affected by this vulnerability. There is no known workaround for the second vulnerability at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-22.1-r3"
The movemail utility shipped with GNU Emacs and XEmacs contains several format string vulnerabilities, potentially leading to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 21.4 | >= 21.4, < 19 |
| app-editors/xemacs | * | < 21.4.15-r3 | >= 21.4.15-r3 |
GNU Emacs and XEmacs are highly extensible and customizable text editors. movemail is an Emacs utility that can fetch mail on remote mail servers.
Max Vozeler discovered that the movemail utility contains several format string errors.
An attacker could set up a malicious POP server and entice a user to connect to it using movemail, resulting in the execution of arbitrary code with the rights of the victim user.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-21.4"
All XEmacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/xemacs-21.4.15-r3"