An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function the parameter file and parameter srcdir come from external input and parameters are not escaped. If a file name or directory name contains shell metacharacters code may be executed.

🗓️ 27 Feb 2023 08:00:00Reported by MicrosoftType

GNU Emacs up to 28.2 has a command injection in htmlfontify.el from unescaped file and srcdir input.

Reporter	Title	Published	Views	Family All 163
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Storage Defender – Data Protect	30 Aug 202317:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture includes components with multiple known vulnerabilities (CVE-2023-2828, CVE-2023-24329, CVE-2022-4839)	14 Nov 202315:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Automation Decision Services December 2023 - Multiple CVEs addressed	15 Jan 202407:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM includes components with known vulnerabilities	24 Oct 202319:01	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.12 addresses multiple security vulnerabilities.	2 Apr 202411:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for December 2023.	17 Jan 202407:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2023 - Multiple CVEs addressed	8 Jan 202409:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data	14 Feb 202418:12	–	ibm
FreeBSD	emacs -- multiple vulnerabilities	6 Dec 202200:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)	21 Mar 202300:00	–	nessus