PT-2023-9284 · Emacs+4 · Emacs+4

Tej Rathi · Published 2023-05-09 · Updated 2025-01-22 · CVE-2023-2491

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Emacs (affected versions not specified)

Description A flaw in the Emacs text editor allows for arbitrary command execution when processing specially crafted org-mode code with the org-babel-execute:latex function in ob-latex.el. The issue is related to the improper neutralization of special elements used in the command, which can be exploited to execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALSA-2023:2626

ALSA-2023:3104

BDU:2024-05925

CESA-2023_3104

CVE-2023-2491

RHSA-2023:2626

RHSA-2023:3104

RHSA-2023_2626

RHSA-2023_3104

Affected Products

Almalinux

Centos

Emacs

Red Hat

Red Os

References · 23

• https://cve.org/CVERecord?id=CVE-2023-2491 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2491 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05925 · Security Note
• https://osv.dev/vulnerability/ALSA-2023:3104 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2023:2626 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-2626.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2491 · Security Note
• https://errata.almalinux.org/8/ALSA-2023-3104.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3104 · Note
• https://bugzilla.redhat.com/2171987 · Note
• https://bugzilla.redhat.com/2192873 · Note
• https://access.redhat.com/security/cve/CVE-2023-2491 · Note
• https://bugzilla.redhat.com/2171989 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-emacs-cve-2022-45939-cve-2023-2491 · Note
• https://bugzilla.redhat.com/2171988 · Note