Threat Intelligence Database

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme (CVE-2025-1244) * emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme [rhel-9.5.z] (CVE-2025-1244) Bug Fix(es): * Eliminate use of obsolete %patchN syntax [rhel-9.5.z] (JIRA:RHEL-80450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

This advisory addresses multiple security vulnerabilities in GNU Emacs as packaged for Red Hat Enterprise Linux 8. The issues include Gnus treating inline MIME contents as trusted, Org mode considering contents of remote files as trusted, and unsafe evaluation of arbitrary Elisp code via org-link-expand-abbrev. These vulnerabilities could lead to execution of untrusted code or improper trust assumptions in Emacs features. Red Hat has released updated packages to fix these issues in Emacs 26.1-12.el8_10 for various architectures.

A moderate severity vulnerability (CVE-2024-39331) in GNU Emacs affects the org-link-expand-abbrev function, which could lead to the evaluation of arbitrary unsafe Elisp code. This issue is addressed by a security update released by Red Hat for their Enterprise Linux 8.8 Extended Update Support versions. The vulnerability involves unsafe code evaluation in Emacs's scripting language (Elisp).