[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZAmHgoA8GvuVpS2V@eldamar.lan>
Date: Thu, 9 Mar 2023 08:15:14 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Shell command and Emacs Lisp code injection in
emacsclient-mail.desktop
Hi,
On Wed, Mar 08, 2023 at 12:37:29PM +0100, Gabriel Corona wrote:
> emacsclient-mail.desktop is vulnerable to shell command
> injections and Emacs Lisp injections through a crafted
> mailto: URI.
Two CVEs are assigned by MITRE:
>
> This has been introduced in Emacs 28.1:
>
> http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=b1b05c828d67930bb3b897fe98e1992db42cf23c
>
> A fix for shell command injection is currently included
> in the upcoming 28.3 branch:
>
> http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467
CVE-2023-27985
>
> A fix for both is currently included in the upcoming 29.1 branch:
>
> http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=3c1693d08b0a71d40a77e7b40c0ebc42dca2d2cc
CVE-2023-27986
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
