PT-2023-21850 · Gnu Emacs+10 · Gnu Emacs+10

Lux + 1 · Publicado 2023-03-18 · Atualizado 2025-08-14 · CVE-2023-28617

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Org Mode versions through 9.6.1

Description The issue allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. This is possible due to a flaw in the org-babel-execute:latex function in ob-latex.el for GNU Emacs.

Recommendations For versions through 9.6.1, consider disabling the org-babel-execute:latex function until a patch is available to prevent the execution of arbitrary commands. Restrict access to file names and directory names that may contain shell metacharacters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

ALSA-2023:1930

ALSA-2023:2074

ALSA-2023:2626

ALSA-2023:3104

AZL-25707

BDU:2025-11741

CESA-2023_1930

CVE-2023-28617

DLA-3416-1

DLA-3616-1

DLA-4069-1

MGASA-2023-0152

OESA-2023-1185

RHSA-2023:1915

RHSA-2023:1930

RHSA-2023:1931

RHSA-2023:1958

RHSA-2023:2010

RHSA-2023:2074

RHSA-2023:3189

RHSA-2023_1930

RHSA-2023_2074

RLSA-2023:1930

RLSA-2023:2074

USN-6003-1

USN-7027-1

USN-7375-1

Produtos afetados

Almalinux

Astra Linux

Centos

Debian

Gnu Emacs

Linuxmint

Org Mode

Red Hat

Red Os

Rocky Linux

Ubuntu

Referências · 76

• https://access.redhat.com/security/cve/CVE-2022-48339 · Nota
• https://ubuntu.com/security/notices/USN-6003-1 · Aviso do Fabricante
• https://errata.almalinux.org/8/ALSA-2023-1930.html · Aviso do Fabricante
• https://osv.dev/vulnerability/ALSA-2023:3104 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:3104 · Nota
• https://osv.dev/vulnerability/DLA-3616-1 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2023-28617 · Nota
• https://bugzilla.redhat.com/2171987 · Nota
• https://access.redhat.com/security/cve/CVE-2022-48337 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-28617 · Nota de Segurança
• https://ubuntu.com/security/CVE-2022-48339 · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html · Nota
• https://bugs.mageia.org/show_bug.cgi?id=31767 · Nota
• https://errata.almalinux.org/9/ALSA-2023-2074.html · Aviso do Fabricante
• https://list.orgmode.org/[e-mail]/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e · Nota