Vulnerability · Published May 17, 2023 · Assigned by redhat
CVE-2023-2491
High 7.8
In plain English
A high-severity command injection in emacs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | emacs | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
| AlmaLinux:9 | emacs | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:8 | emacs-common | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
| AlmaLinux:9 | emacs-common | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:8 | emacs-filesystem | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
| AlmaLinux:9 | emacs-filesystem | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:8 | emacs-lucid | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
| AlmaLinux:9 | emacs-lucid | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:8 | emacs-nox | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
| AlmaLinux:9 | emacs-nox | 1:27.2-8.el9_2.1 | ALSA-2023:2626 |
| AlmaLinux:8 | emacs-terminal | 1:26.1-10.el8_8.2 | ALSA-2023:3104 |
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H