FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-05-02 10:37:19 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
f661184a-eb90-11ee-92fc-1c697a616631emacs -- multiple vulnerabilities

GNU Emacs developers report:

Emacs 29.3 is an emergency bugfix release intended to fix several security vulnerabilities.

  • Arbitrary Lisp code is no longer evaluated as part of turning on Org mode. This is for security reasons, to avoid evaluating malicious Lisp code.
  • New buffer-local variable 'untrusted-content'. When this is non-nil, Lisp programs should treat buffer contents with extra caution.
  • Gnus now treats inline MIME contents as untrusted. To get back previous insecure behavior, 'untrusted-content' should be reset to nil in the buffer.
  • LaTeX preview is now by default disabled for email attachments. To get back previous insecure behavior, set the variable 'org--latex-preview-when-risky' to a non-nil value.
  • Org mode now considers contents of remote files to be untrusted. Remote files are recognized by calling 'file-remote-p'.

Discovery 2024-03-24
Entry 2024-03-26
emacs
emacs-canna
emacs-nox
< 29.3,3

CVE-2024-30202
CVE-2024-30203
CVE-2024-30204
CVE-2024-30205
https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29.3
a75929bd-b6a4-11ed-bad6-080027f5fec9emacs -- multiple vulnerabilities

Xi Lu reports:

CVE-2022-48337
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
CVE-2022-48338
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
CVE-2022-48339
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

Discovery 2022-12-06
Entry 2023-02-27
emacs
emacs-canna
emacs-nox
< 28.2_3,3

emacs-devel
emacs-devel-nox
< 30.0.50.20230101,3

CVE-2022-48337
CVE-2022-48338
CVE-2022-48339
https://www.debian.org/security/2023/dsa-5360
76e2fcce-92d2-11ed-a635-080027f5fec9emacs -- arbitary shell command execution vulnerability of ctags

lu4nx reports:

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.


Discovery 2022-11-28
Entry 2023-01-12
emacs
emacs-canna
emacs-nox
< 28.2_2,3

emacs-devel
emacs-devel-nox
< 30.0.50.202211128,2

CVE-2022-45939
https://nvd.nist.gov/vuln/detail/CVE-2022-45939
c1e5f35e-f93d-11e1-b07f-00235a5f2c9aemacs -- remote code execution vulnerability

Chong Yidong reports:

Paul Ling has found a security flaw in the file-local variables code in GNU Emacs.

When the Emacs user option `enable-local-variables' is set to `:safe' (the default value is t), Emacs should automatically refuse to evaluate `eval' forms in file-local variable sections. Due to the bug, Emacs instead automatically evaluates such `eval' forms. Thus, if the user changes the value of `enable-local-variables' to `:safe', visiting a malicious file can cause automatic execution of arbitrary Emacs Lisp code with the permissions of the user.

The bug is present in Emacs 23.2, 23.3, 23.4, and 24.1.


Discovery 2012-08-13
Entry 2012-09-08
Modified 2013-05-13
emacs
gt 24.* lt 24.2

gt 23.* le 23.4_2

54969
CVE-2012-3479
https://lists.gnu.org/archive/html/emacs-devel/2012-08/msg00802.html
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12155