SUSE update for emacs

Published: 2024-04-16

Risk	High
Patch available	YES
Number of vulnerabilities	3
CVE-ID	CVE-2024-30203 CVE-2024-30204 CVE-2024-30205
CWE-ID	CWE-345
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Server for SAP Applications 12 Operating systems & Components / Operating system SUSE Linux Enterprise Server 12 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 12 Operating systems & Components / Operating system emacs-info Operating systems & Components / Operating system package or component emacs-el Operating systems & Components / Operating system package or component emacs Operating systems & Components / Operating system package or component etags-debuginfo Operating systems & Components / Operating system package or component etags Operating systems & Components / Operating system package or component emacs-debugsource Operating systems & Components / Operating system package or component emacs-debuginfo Operating systems & Components / Operating system package or component emacs-nox-debuginfo Operating systems & Components / Operating system package or component emacs-x11-debuginfo Operating systems & Components / Operating system package or component emacs-nox Operating systems & Components / Operating system package or component emacs-x11 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Insufficient verification of data authenticity

EUVDB-ID: #VU87808

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-30203

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Gnus treats inline MIME contents as trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Mitigation

Update the affected package emacs to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

emacs-info: before 24.3-25.17.1

emacs-el: before 24.3-25.17.1

emacs: before 24.3-25.17.1

etags-debuginfo: before 24.3-25.17.1

etags: before 24.3-25.17.1

emacs-debugsource: before 24.3-25.17.1

emacs-debuginfo: before 24.3-25.17.1

emacs-nox-debuginfo: before 24.3-25.17.1

emacs-x11-debuginfo: before 24.3-25.17.1

emacs-nox: before 24.3-25.17.1

emacs-x11: before 24.3-25.17.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241317-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficient verification of data authenticity

EUVDB-ID: #VU87809

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-30204

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to LaTeX preview is enabled by default for e-mail attachments. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Mitigation

Update the affected package emacs to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

emacs-info: before 24.3-25.17.1

emacs-el: before 24.3-25.17.1

emacs: before 24.3-25.17.1

etags-debuginfo: before 24.3-25.17.1

etags: before 24.3-25.17.1

emacs-debugsource: before 24.3-25.17.1

emacs-debuginfo: before 24.3-25.17.1

emacs-nox-debuginfo: before 24.3-25.17.1

emacs-x11-debuginfo: before 24.3-25.17.1

emacs-nox: before 24.3-25.17.1

emacs-x11: before 24.3-25.17.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241317-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Insufficient verification of data authenticity

EUVDB-ID: #VU87804

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-30205

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to Emacs in Org mode considers contents of remote files to be trusted. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Mitigation

Update the affected package emacs to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Server for SAP Applications 12: SP5

SUSE Linux Enterprise Server 12: SP5

SUSE Linux Enterprise High Performance Computing 12: SP5

emacs-info: before 24.3-25.17.1

emacs-el: before 24.3-25.17.1

emacs: before 24.3-25.17.1

etags-debuginfo: before 24.3-25.17.1

etags: before 24.3-25.17.1

emacs-debugsource: before 24.3-25.17.1

emacs-debuginfo: before 24.3-25.17.1

emacs-nox-debuginfo: before 24.3-25.17.1

emacs-x11-debuginfo: before 24.3-25.17.1

emacs-nox: before 24.3-25.17.1

emacs-x11: before 24.3-25.17.1

External links

http://www.suse.com/support/update/announcement/2024/suse-su-20241317-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.