Red Hat Product Security issued an advisory (RHSA-2024:6987) for GNU Emacs on Red Hat Enterprise Linux 8 addressing three vulnerabilities: CVE-2024-30203 where Gnus treats inline MIME contents as trusted, CVE-2024-30205 where Org mode trusts contents of remote files, and CVE-2024-39331 where org-link-expand-abbrev could evaluate arbitrary unsafe Elisp code. These issues relate to improper trust handling and unsafe code evaluation in Emacs features. The advisory provides updated Emacs packages (version 26.1-12.el8_10) that fix these vulnerabilities across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated as having a Moderate security impact by Red Hat. No CVSS scores are provided in the advisory, but the vulnerabilities involve potential code execution risks due to unsafe trust assumptions and code evaluation.

The vulnerabilities allow Emacs components to treat untrusted content as trusted or to evaluate arbitrary unsafe Elisp code. This can lead to execution of malicious code within the Emacs environment, potentially compromising the user's system or data. The impact is limited to users of affected Emacs versions on Red Hat Enterprise Linux 8 and its variants. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Emacs packages (version 26.1-12.el8_10) that address these vulnerabilities. Users of Red Hat Enterprise Linux 8 should apply the security update promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). This update fixes the issues related to trusted content handling and unsafe Elisp code evaluation. No additional mitigation steps are indicated by the vendor.