CVE-2024-39331 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre	CNA	---				---
CISA-ADP	ADP	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 62%

Vendor	Product	Version
gnu	emacs	𝑥 < 29.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

emacs

bullseye	1:27.1+1-3.1+deb11u5 fixed
bookworm	1:28.2+1-15+deb12u4 ignored
bullseye (security)	1:27.1+1-3.1+deb11u6 fixed
bookworm (security)	1:28.2+1-15+deb12u4 fixed
trixie	1:30.1+1-6 fixed
forky	1:30.2+1-1 fixed
sid	1:30.2+1-2 fixed

org-mode

bullseye (security)	9.4.0+dfsg-1+deb11u3 fixed
bullseye	9.4.0+dfsg-1+deb11u3 fixed
bookworm	ignored
trixie	9.7.29+dfsg-1 fixed
forky	9.7.36+dfsg-1 fixed
sid	9.7.36+dfsg-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

emacs

questing	not-affected
plucky	not-affected
oracular	not-affected
noble	Fixed 1:29.3+1-1ubuntu2+esm1 released
mantic	ignored
jammy	Fixed 1:27.1+1-3ubuntu5.2 released
focal	Fixed 1:26.3+1-1ubuntu2+esm1 released

xemacs21

questing	needs-triage
plucky	needs-triage
oracular	ignored
noble	needs-triage
mantic	ignored
jammy	needs-triage
focal	needs-triage
bionic	needs-triage
xenial	needs-triage

xemacs21-packages

questing	needs-triage
plucky	needs-triage
oracular	ignored
noble	needs-triage
mantic	ignored
jammy	needs-triage
focal	needs-triage
bionic	needs-triage
xenial	needs-triage

emacs24

questing	dne
plucky	dne
oracular	dne
noble	dne
mantic	dne
jammy	dne
focal	dne
xenial	Fixed 24.5+1-6ubuntu1.1+esm4 released

emacs25

questing	dne
plucky	dne
oracular	dne
noble	dne
mantic	dne
jammy	dne
focal	dne
bionic	Fixed 25.2+1-6ubuntu0.1~esm2 released

org-mode

questing	not-affected
plucky	not-affected
oracular	not-affected
noble	Fixed 9.6.10+dfsg-1ubuntu0.1~esm1 released
mantic	ignored
jammy	Fixed 9.5.2+dfsh-4ubuntu0.1~esm1 released
focal	Fixed 9.3.1+dfsg-1ubuntu0.1~esm1 released
bionic	Fixed 9.1.6+dfsg-1ubuntu0.1~esm1 released
xenial	Fixed 8.3.3-2ubuntu0.1~esm1 released

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References

https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29

https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8

https://list.orgmode.org/87sex5gdqc.fsf%40localhost/

https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html

https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html

https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html

https://news.ycombinator.com/item?id=40768225

https://www.openwall.com/lists/oss-security/2024/06/23/1

https://www.openwall.com/lists/oss-security/2024/06/23/2

https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29

https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8

https://list.orgmode.org/87sex5gdqc.fsf%40localhost/

https://lists.debian.org/debian-lts-announce/2024/06/msg00023.html

https://lists.debian.org/debian-lts-announce/2024/06/msg00024.html

https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html

https://news.ycombinator.com/item?id=40768225

https://www.openwall.com/lists/oss-security/2024/06/23/1

https://www.openwall.com/lists/oss-security/2024/06/23/2