Arbitrary Command Execution Vulnerability in Emacs Text Editor by Red Hat
CVE-2023-2491

7.8HIGH

Key Information:

Vendor
Gnu
Status
emacs
Vendor
CVE Published:
17 May 2023

Summary

A vulnerability exists in the Emacs text editor that allows an attacker to execute arbitrary commands through the processing of specially crafted org-mode code. The flaw specifically lies in the 'org-babel-execute:latex' function within the ob-latex.el file. This vulnerability is a consequence of another identified security regression, providing a potential attack vector on Red Hat Enterprise Linux versions 8.8 and 9.2.

Affected Version(s)

emacs Affects emacs v26.1-9.el8 and emacs v27.2-8.el9, Fixed in emacs v26.1-10.el8_8.2 and emacs v27.2-8.el9_2.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=2192873
https://access.redhat.com/security/cve/CVE-2023-2491
https://access.redhat.com/errata/RHSA-2023:3104

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.