GNU Emacs 27.1

CPE Details

GNU Emacs 27.1
gnu
emacs
27.1
2023-02-27
19h10 +00:00
2023-03-03
17h09 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:gnu:emacs:27.1:*:*:*:*:*:*:*

Informations

Vendor

gnu

Product

emacs

Version

27.1

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2022-48337 2023-02-20 00h00 +00:00 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
9.8
Critical
CVE-2022-48338 2023-02-20 00h00 +00:00 An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
7.3
High
CVE-2022-48339 2023-02-20 00h00 +00:00 An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
7.8
High
CVE-2022-45939 2022-11-27 23h00 +00:00 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
7.8
High
CVE-2007-6109 2007-12-07 10h00 +00:00 Stack-based buffer overflow in emacs allows user-assisted attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a large precision value in an integer format string specifier to the format function, as demonstrated via a certain "emacs -batch -eval" command line.
10