Remote Code Execution in GNU Emacs by Exploiting Email Processing

CVE-2017-14482

What is CVE-2017-14482?

GNU Emacs versions prior to 25.3 are susceptible to a vulnerability that enables remote attackers to execute arbitrary code. This arises from the unsafe handling of email content with the 'Content-Type: text/enriched' header, where specifically crafted inputs can lead to the execution of shell commands. Users are particularly at risk when they read malicious email messages or Usenet articles. Attackers can leverage the unsafe extensions within lisp/textmodes/enriched.el and Gnus support for inline MIME objects in lisp/gnus/mm-view.el to compromise the Emacs environment instantly.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References