Fluid Attacks Database

Description

An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	emacs	=1:27.1+1-3.1 \|\| =1:27.1+1-3.1+deb11u1 \|\| >=0 <1:27.1+1-3.1+deb11u2	1:27.1+1-3.1+deb11u2
debian 12	emacs	>=0 <1:28.2+1-11	1:28.2+1-11
debian 13	emacs	>=0 <1:28.2+1-11	1:28.2+1-11
debian 14	emacs	>=0 <1:28.2+1-11	1:28.2+1-11
rpm rhel9	emacs	<1:27.2-8.el9_2.1	1:27.2-8.el9_2.1
rpm rhel7	emacs	-	-
rpm rhel8	emacs	-	-
rpm rhel6	emacs	-	-

Aliases

1. CVE-2022-483382. NVD-2022-483383. OSV-DEBIAN-2022-483384. OSV-2022-483385. SECURITY-TRACKER-CVE-2022-48338

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.