Fluid Attacks Database

Description

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	emacs	>=0 <1:28.2+1-13	1:28.2+1-13
debian 13	emacs	>=0 <1:28.2+1-13	1:28.2+1-13
debian 12	emacs	>=0 <1:28.2+1-13	1:28.2+1-13

Aliases

1. CVE-2023-279852. NVD-2023-279853. OSV-DEBIAN-2023-279854. OSV-2023-279855. SECURITY-TRACKER-CVE-2023-27985

References

1. http://www.openwall.com/lists/oss-security/2023/03/09/12. https://www.openwall.com/lists/oss-security/2023/03/08/23. http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba0004674. https://debbugs.gnu.org/cgi/bugreport.cgi?bug=602045. https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.