CVE-2024-39331

2024-06-2322:15:09

Debian Security Bug Tracker

security-tracker.debian.org

emacs

org-link-expand-abbrev

lisp/ol.el

unsafe function

shell-command-to-string

org mode

7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.4%

JSON

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(…) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

OSVersionArchitecturePackageVersionFilename
Debian12allemacs< 1:28.2+1-15+deb12u3emacs_1:28.2+1-15+deb12u3_all.deb
Debian11allemacs< 1:27.1+1-3.1+deb11u5emacs_1:27.1+1-3.1+deb11u5_all.deb
Debian10allemacs<= 1:26.1+1-3.2+deb10u2emacs_1:26.1+1-3.2+deb10u2_all.deb
Debian999allemacs< 1:29.4+1-1emacs_1:29.4+1-1_all.deb
Debian13allemacs<= 1:29.3+1-3emacs_1:29.3+1-3_all.deb
Debian12allorg-mode<= 9.5.2+dfsh-5org-mode_9.5.2+dfsh-5_all.deb
Debian11allorg-mode< 9.4.0+dfsg-1+deb11u3org-mode_9.4.0+dfsg-1+deb11u3_all.deb
Debian10allorg-mode<= 9.1.14+dfsg-3org-mode_9.1.14+dfsg-3_all.deb
Debian999allorg-mode< 9.7.5+dfsg-1org-mode_9.7.5+dfsg-1_all.deb
Debian13allorg-mode<= 9.6.28+dfsg-1org-mode_9.6.28+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	emacs	< 1:28.2+1-15+deb12u3	emacs_1:28.2+1-15+deb12u3_all.deb
Debian	11	all	emacs	< 1:27.1+1-3.1+deb11u5	emacs_1:27.1+1-3.1+deb11u5_all.deb
Debian	10	all	emacs	<= 1:26.1+1-3.2+deb10u2	emacs_1:26.1+1-3.2+deb10u2_all.deb
Debian	999	all	emacs	< 1:29.4+1-1	emacs_1:29.4+1-1_all.deb
Debian	13	all	emacs	<= 1:29.3+1-3	emacs_1:29.3+1-3_all.deb
Debian	12	all	org-mode	<= 9.5.2+dfsh-5	org-mode_9.5.2+dfsh-5_all.deb
Debian	11	all	org-mode	< 9.4.0+dfsg-1+deb11u3	org-mode_9.4.0+dfsg-1+deb11u3_all.deb
Debian	10	all	org-mode	<= 9.1.14+dfsg-3	org-mode_9.1.14+dfsg-3_all.deb
Debian	999	all	org-mode	< 9.7.5+dfsg-1	org-mode_9.7.5+dfsg-1_all.deb
Debian	13	all	org-mode	<= 9.6.28+dfsg-1	org-mode_9.6.28+dfsg-1_all.deb