Threat database

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme (CVE-2025-1244) * emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme [rhel-9.5.z] (CVE-2025-1244) Bug Fix(es): * Eliminate use of obsolete %patchN syntax [rhel-9.5.z] (JIRA:RHEL-80450) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer the CVE page(s) listed in the References section.

Multiple security vulnerabilities were identified in GNU Emacs as packaged for Red Hat Enterprise Linux 8. These include Gnus treating inline MIME contents as trusted, Org mode considering contents of remote files as trusted, and unsafe evaluation of arbitrary Elisp code via org-link-expand-abbrev. These issues could lead to execution of untrusted code or improper trust assumptions within Emacs features. Red Hat has released updated packages to address these vulnerabilities in Emacs version 26.1-12.el8_10 across various architectures.

A security update for GNU Emacs addresses a vulnerability in the org-link-expand-abbrev function that could allow evaluation of arbitrary unsafe Elisp code. This vulnerability, tracked as CVE-2024-39331, affects certain versions of Emacs distributed with Red Hat Enterprise Linux 8.8 and related SUSE packages. The issue has been rated with moderate severity by Red Hat. The update prevents unsafe code evaluation, mitigating the risk. No known exploits have been reported in the wild.