Log in Start free

Vulnerability · Published Mar 9, 2023 · Assigned by mitre

CVE-2023-27985

High 7.8

In plain English

A high-severity OS command injection in the emacs package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.1%top 34.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is fixed in 29.0.90

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20emacs28.2-r5ALPINE-CVE-2023-27985
Alpine:v3.21emacs28.2-r5ALPINE-CVE-2023-27985
Alpine:v3.22emacs28.2-r5ALPINE-CVE-2023-27985
Alpine:v3.23emacs28.2-r5ALPINE-CVE-2023-27985
Alpine:v3.24emacs28.2-r5ALPINE-CVE-2023-27985
Debian:12emacs1:28.2+1-13DEBIAN-CVE-2023-27985
Debian:13emacs1:28.2+1-13DEBIAN-CVE-2023-27985
Debian:14emacs1:28.2+1-13DEBIAN-CVE-2023-27985
Ubuntu:22.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-27985
Ubuntu:24.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-27985
Ubuntu:25.10xemacs21no fix listedUBUNTU-CVE-2023-27985
Ubuntu:26.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-27985
Ubuntu:26.10xemacs21no fix listedUBUNTU-CVE-2023-27985
Ubuntu:22.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-27985
Ubuntu:24.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-27985
Ubuntu:25.10xemacs21-packagesno fix listedUBUNTU-CVE-2023-27985
Ubuntu:26.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-27985
Ubuntu:26.10xemacs21-packagesno fix listedUBUNTU-CVE-2023-27985

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References