Use of Potentially Dangerous Function in Emacs - CVE-2024-30202

Vulnerability identifier: #VU87807

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30202

CWE-ID: CWE-676

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to usage of dangerous method when processing untrusted files. A remote attacker can trick the victim to open a specially crafted document and execute arbitrary Lisp code as part of turning on Org mode.

Emacs
Oracle Solaris
Gentoo Linux
Amazon Linux AMI
Ubuntu
Anolis OS
Fedora
elpa-org (Ubuntu package)
org-mode (Ubuntu package)
app-editors/emacs
emacs
emacs-common
emacs-devel
emacs-lucid
emacs-nox
emacs-doc
emacs-filesystem
emacs-terminal

Install updates from vendor's website.

Emacs - update to 29.3
Oracle Solaris - update to 11.4 SRU 71
elpa-org (Ubuntu package) - update to Ubuntu Pro
org-mode (Ubuntu package) - update to Ubuntu Pro
app-editors/emacs - update to 9.6.23
emacs - update to 28.2-3
emacs - addressed in versions 29.3-1.fc38, 29.3-1.fc39, 29.3-1.fc40
emacs - update to 29.4-1
emacs-common - update to 29.4-1
emacs-devel - update to 29.4-1
emacs-lucid - update to 29.4-1
emacs-nox - update to 29.4-1
emacs-doc - update to 29.4-1
emacs-filesystem - update to 29.4-1
emacs-terminal - update to 29.4-1

• https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
• https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9
• https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb

• Multiple vulnerabilities in GNU Emacs
• Fedora 40 update for emacs
• Fedora 39 update for emacs
• Fedora 38 update for emacs
• Gentoo update for GNU Emacs, Org Mode
• Amazon Linux AMI update for emacs
• Oracle Solaris update for thrid-party components
• Ubuntu update for org-mode
• Anolis OS update for emacs