GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.

🗓️ 28 Feb 2023 08:00:00Reported by MicrosoftType

GNU Emacs up to 28.2 allows command execution via shell metacharacters in etags file names.

Reporter	Title	Published	Views	Family All 140
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services December 2023 - Multiple CVEs addressed	15 Jan 202407:33	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.12 addresses multiple security vulnerabilities.	2 Apr 202411:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2023.	17 Jan 202407:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2023 - Multiple CVEs addressed	8 Jan 202409:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data	14 Feb 202418:12	–	ibm
FreeBSD	emacs -- multiple vulnerabilities	6 Dec 202200:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)	21 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux 2 : emacs (ALAS-2023-1981)	7 Mar 202300:00	–	nessus
Tenable Nessus	Amazon Linux AMI : emacs (ALAS-2023-1712)	6 Apr 202300:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0154: emacs (ALINUX3-SA-2023:0154)	14 May 202500:00	–	nessus