Log in Start free

Vulnerability · Published Feb 20, 2023 · Assigned by mitre

CVE-2022-48339

High 7.8

In plain English

A high-severity security flaw in the emacs package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.1%top 33.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8emacs1:26.1-11.el8ALSA-2023:7083
AlmaLinux:9emacs1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-common1:26.1-11.el8ALSA-2023:7083
AlmaLinux:9emacs-common1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-filesystem1:26.1-11.el8ALSA-2023:7083
AlmaLinux:9emacs-filesystem1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-lucid1:26.1-11.el8ALSA-2023:7083
AlmaLinux:9emacs-lucid1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-nox1:26.1-11.el8ALSA-2023:7083
AlmaLinux:9emacs-nox1:27.2-8.el9_2.1ALSA-2023:2626
AlmaLinux:8emacs-terminal1:26.1-11.el8ALSA-2023:7083
Debian:12emacs1:28.2+1-11DEBIAN-CVE-2022-48339
Debian:13emacs1:28.2+1-11DEBIAN-CVE-2022-48339
Debian:14emacs1:28.2+1-11DEBIAN-CVE-2022-48339
Rocky Linux:8emacs1:26.1-11.el8RLSA-2023:7083
Ubuntu:22.04:LTSemacs1:27.1+1-3ubuntu5.2USN-7027-1
Ubuntu:22.04:LTSemacs1:27.1+1-3ubuntu5.2UBUNTU-CVE-2022-48339
Ubuntu:22.04:LTSxemacs21no fix listedUBUNTU-CVE-2022-48339
Ubuntu:24.04:LTSxemacs21no fix listedUBUNTU-CVE-2022-48339
Ubuntu:25.10xemacs21no fix listedUBUNTU-CVE-2022-48339
Ubuntu:26.04:LTSxemacs21no fix listedUBUNTU-CVE-2022-48339
Ubuntu:26.10xemacs21no fix listedUBUNTU-CVE-2022-48339
Ubuntu:22.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2022-48339
Ubuntu:24.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2022-48339
Ubuntu:25.10xemacs21-packagesno fix listedUBUNTU-CVE-2022-48339
Ubuntu:26.04:LTSxemacs21-packagesno fix listedUBUNTU-CVE-2022-48339
Ubuntu:26.10xemacs21-packagesno fix listedUBUNTU-CVE-2022-48339

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-1116 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References