Emacs and Org Mode fix 1 critical vulnerability

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Emacs and Org Mode fix 1 critical vulnerability

Emacs and Org Mode are fixing 1 critical vulnerability. Emacs fixes the vulnerability in version 29.4 and Org Mode in version 9.7.5 [1]. A patch is available at [2] and is applicable to the Org Mode Git repository. The vulnerability in Emacs has so far been fixed only by Slackware [3].

Emacs Org mode - shell command execution

An unauthenticated remote attacker can execute shell commands by sending an e-mail containing a specially crafted ".org" file. To exploit the vulnerability, it is sufficient for the victim to preview the e-mail in Emacs with Org Mode. A PoC is also available for the vulnerability and can be found at [1].

The vulnerability is present in products:

Emacs; <29.4;
Org Mode <9.7.5;

More information:

CWE-78 at cwe.mitre.org

The vulnerability was publicly disclosed 23. 6. 2024.

Links

By CESNET, z.s.p.o. Martin Krajči on 24. 6. 2024.

Report feedback

[TLP:CLEAR] Emacs and Org Mode fix 1 critical vulnerability

Emacs Org mode - shell command execution

Links