This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Emacs 29.3 fixes 4 vulnerabilities
An attacker can force Org mode to access potentially dangerous files [1] [2] [3].
The vulnerability is present in product:
- Emacs; <29.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
More information:
- CVE-2024-30205 at cve.org, NVD
- CWE-345 at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2024.
An attacker can inject malicious code that may be executed when generating a preview of e-mail attachments [4] [5].
The vulnerability is present in product:
- Emacs; <29.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
More information:
- CVE-2024-30204 at cve.org, NVD
- CWE-345 at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2024.
An attacker can inject malicious code into e-mails that contain MIME content, which is then processed by Gnus as trusted [6] [7].
The vulnerability is present in product:
- Emacs; <29.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
More information:
- CVE-2024-30203 at cve.org, NVD
- CWE-345 at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2024.
An attacker can execute arbitrary Lisp code as part of enabling Org mode [8] [9] [10].
The vulnerability is present in product:
- Emacs; <29.3
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-30202 at cve.org, NVD
- CWE-676 at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2024.
the Emacs text editor version 29.3 fixes 4 vulnerabilities [11] [12].
Links
- [1] https://nvd.nist.gov/vuln/detail/CVE-2024-30205
- [2] https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=2bc865ace050ff118db43f01457f95f95112b877
- [3] https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=4255d5dcc0657915f90e4fba7e0a5514cced514d
- [4] https://nvd.nist.gov/vuln/detail/CVE-2024-30204
- [5] https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c
- [6] https://nvd.nist.gov/vuln/detail/CVE-2024-30203
- [7] https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=937b9042ad7426acdcca33e3d931d8f495bdd804
- [8] https://nvd.nist.gov/vuln/detail/CVE-2024-30202
- [9] https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb
- [10] https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9
- [11] https://lists.gnu.org/archive/html/info-gnu/2024-03/msg00005.html
- [12] https://www.openwall.com/lists/oss-security/2024/03/25/2
By CESNET, z.s.p.o. Michaela Jarošová on 27. 3. 2024.