A vulnerability has been found in GNU Emacs and org-mode which could result in arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 26.3-r19:26, < 27.2-r17:27, < 28.2-r13:28, < 29.3-r3:29 | >= 26.3-r19:26, >= 27.2-r17:27, >= 28.2-r13:28, >= 29.3-r3:29 |
| app-emacs/org-mode | * | < 9.7.5 | >= 9.7.5 |
GNU Emacs is the extensible, customizable, self-documenting real-time display editor. org-mode is an Emacs mode for notes and project planning.
%(...) link abbreviations could specify unsafe functions.
Opening a malicious org-mode file could result in arbitrary code execution.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version according to the installed slot, one of:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-26.3-r19:26"
Alternatively:
# emerge --ask --oneshot --verbose ">=app-editors/emacs-27.2-r17:27"
# emerge --ask --oneshot --verbose ">=app-editors/emacs-28.2-r13:28"
# emerge --ask --oneshot --verbose ">=app-editors/emacs-29.3-r3:29"
All org-mode users should upgrade to the latest package:
# emerge --ask --oneshot --verbose ">=app-emacs/org-mode-9.7.5"
Multiple vulnerabilities have been discovered in GNU Emacs and Org Mode, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-editors/emacs | * | < 26.3-r16:26, < 27.2-r14:27, < 28.2-r10:28, < 29.2-r1:29 | >= 26.3-r16:26, >= 27.2-r14:27, >= 28.2-r10:28, >= 29.2-r1:29 |
| app-emacs/org-mode | * | < 9.6.23 | >= 9.6.23 |
GNU Emacs is a highly extensible and customizable text editor.
Multiple vulnerabilities have been discovered in GNU Emacs. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All GNU Emacs users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-editors/emacs-29.3-r2"
All Org Mode users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emacs/org-mode-9.6.23"