Ubuntu.comUB:CVE-2024-39331CVE-2024-39331
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(…)
link abbrev even when it specifies an unsafe function, such as
shell-command-to-string. This affects Org Mode before 9.7.5.
Bugs
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 20.04 | noarch | emacs | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | emacs | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | emacs | < any | UNKNOWN |
| ubuntu | 24.04 | noarch | emacs | < any | UNKNOWN |
| ubuntu | 16.04 | noarch | emacs24 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | emacs25 | < any | UNKNOWN |
| ubuntu | 18.04 | noarch | org-mode | < any | UNKNOWN |
| ubuntu | 20.04 | noarch | org-mode | < any | UNKNOWN |
| ubuntu | 22.04 | noarch | org-mode | < any | UNKNOWN |
| ubuntu | 23.10 | noarch | org-mode | < any | UNKNOWN |
References
git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8
launchpad.net/bugs/cve/CVE-2024-39331
list.orgmode.org/87sex5gdqc.fsf%40localhost/
lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html
news.ycombinator.com/item?id=40768225
nvd.nist.gov/vuln/detail/CVE-2024-39331
security-tracker.debian.org/tracker/CVE-2024-39331
www.cve.org/CVERecord?id=CVE-2024-39331
www.openwall.com/lists/oss-security/2024/06/23/1
www.openwall.com/lists/oss-security/2024/06/23/2
Related
