Fluid Attacks Database

Description

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	emacs	>=0 <1:28.2+1-14	1:28.2+1-14
debian 14	org-mode	>=0 <9.5.2+dfsh-5	9.5.2+dfsh-5
debian 11	emacs	=1:27.1+1-3.1 \|\| =1:27.1+1-3.1+deb11u1 \|\| =1:27.1+1-3.1+deb11u2 \|\| =1:27.1+1-3.1+deb11u3 \|\| =1:27.1+1-3.1+deb11u4 \|\| =1:27.1+1-3.1+deb11u5 \|\| >=0 <1:27.1+1-3.1+deb11u6	1:27.1+1-3.1+deb11u6
debian 11	org-mode	=9.4.0+dfsg-1 \|\| >=0 <9.4.0+dfsg-1+deb11u1	9.4.0+dfsg-1+deb11u1
debian 12	emacs	>=0 <1:28.2+1-14	1:28.2+1-14
debian 12	org-mode	>=0 <9.5.2+dfsh-5	9.5.2+dfsh-5
debian 13	org-mode	>=0 <9.5.2+dfsh-5	9.5.2+dfsh-5
debian 14	emacs	>=0 <1:28.2+1-14	1:28.2+1-14
rpm rhel8	emacs	<1:26.1-7.el8_7.1	1:26.1-7.el8_7.1
rpm rhel8.4	emacs	<1:26.1-5.el8_4.1	1:26.1-5.el8_4.1

1-10 of 13

Aliases

1. CVE-2023-286172. NVD-2023-286173. OSV-DEBIAN-2023-286174. OSV-2023-286175. SECURITY-TRACKER-CVE-2023-28617

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.