CVE-2022-45939
28.11.2022, 06:15
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
| Vendor | Product | Version |
|---|---|---|
| gnu | emacs | 𝑥 ≤ 28.2 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| emacs |
| ||||||||||||||
| xemacs21 |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| emacs |
| ||||||||||||||||||
| emacs23 |
| ||||||||||||||||||
| emacs24 |
| ||||||||||||||||||
| emacs25 |
| ||||||||||||||||||
| xemacs21 |
| ||||||||||||||||||
| xemacs21-packages |
|
References