OS Command Injection in Emacs - CVE-2023-27985

Vulnerability identifier: #VU74003

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-27985

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing data passed via the mailto: URI. A remote attacker can trick the victim to click on a specially crafted link and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Emacs
Amazon Linux AMI
Oracle Solaris
Anolis OS
emacs
emacs-common
emacs-devel
emacs-lucid
emacs-nox
emacs-doc
emacs-filesystem
emacs-terminal

Install update from vendor's website.

emacs - update to 28.2-3
emacs - update to 29.1-1
emacs-common - update to 29.1-1
emacs-devel - update to 29.1-1
emacs-lucid - update to 29.1-1
emacs-nox - update to 29.1-1
emacs-doc - update to 29.1-1
emacs-filesystem - update to 29.1-1
emacs-terminal - update to 29.1-1

• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=60204
• https://www.openwall.com/lists/oss-security/2023/03/08/2
• http://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=d32091199ae5de590a83f1542a01d75fba000467
• http://www.openwall.com/lists/oss-security/2023/03/09/1

• Remote code execution in GNU Emacs
• Multiple vulnerabilities in Oracle Solaris third-party software
• Amazon Linux AMI update for emacs
• Anolis OS update for emacs