Log in Start free

Vulnerability · Published Mar 19, 2023 · Assigned by mitre

CVE-2023-28617

High 7.8

In plain English

A high-severity OS command injection in the emacs package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8emacs1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs1:26.1-7.el8_7.1ALSA-2023:1930
AlmaLinux:9emacs1:27.2-6.el9_1.1ALSA-2023:2074
AlmaLinux:9emacs1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-common1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs-common1:26.1-7.el8_7.1ALSA-2023:1930
AlmaLinux:9emacs-common1:27.2-6.el9_1.1ALSA-2023:2074
AlmaLinux:9emacs-common1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-filesystem1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs-filesystem1:26.1-7.el8_7.1ALSA-2023:1930
AlmaLinux:9emacs-filesystem1:27.2-6.el9_1.1ALSA-2023:2074
AlmaLinux:9emacs-filesystem1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-lucid1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs-lucid1:26.1-7.el8_7.1ALSA-2023:1930
AlmaLinux:9emacs-lucid1:27.2-6.el9_1.1ALSA-2023:2074
AlmaLinux:9emacs-lucid1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-nox1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs-nox1:26.1-7.el8_7.1ALSA-2023:1930
AlmaLinux:9emacs-nox1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:9emacs-nox1:27.2-6.el9_1.1ALSA-2023:2074
AlmaLinux:8emacs-terminal1:26.1-10.el8_8.2ALSA-2023:3104
AlmaLinux:8emacs-terminal1:26.1-7.el8_7.1ALSA-2023:1930
Debian:12emacs1:28.2+1-14DEBIAN-CVE-2023-28617
Debian:13emacs1:28.2+1-14DEBIAN-CVE-2023-28617
Debian:14emacs1:28.2+1-14DEBIAN-CVE-2023-28617
Debian:12org-mode9.5.2+dfsh-5DEBIAN-CVE-2023-28617
Debian:13org-mode9.5.2+dfsh-5DEBIAN-CVE-2023-28617
Debian:14org-mode9.5.2+dfsh-5DEBIAN-CVE-2023-28617
Rocky Linux:8emacs1:26.1-7.el8_7.1RLSA-2023:1930
Rocky Linux:9emacs1:27.2-6.el9_1.1RLSA-2023:2074
Ubuntu:22.04:LTSemacs1:27.1+1-3ubuntu5.2USN-7027-1
Ubuntu:22.04:LTSemacs1:27.1+1-3ubuntu5.2UBUNTU-CVE-2023-28617
Ubuntu:22.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-28617
Ubuntu:24.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-28617
Ubuntu:25.10xemacs21no fix listedUBUNTU-CVE-2023-28617
Ubuntu:26.04:LTSxemacs21no fix listedUBUNTU-CVE-2023-28617
Ubuntu:26.10xemacs21no fix listedUBUNTU-CVE-2023-28617
Ubuntu:22.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-28617
Ubuntu:24.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-28617
Ubuntu:25.10xemacs21-packagesno fix listedUBUNTU-CVE-2023-28617
Ubuntu:26.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2023-28617
Ubuntu:26.10xemacs21-packagesno fix listedUBUNTU-CVE-2023-28617

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References