Vulnerability-Lookup

ubuntu-cve-2022-48338

Vulnerability from osv_ubuntu

Published

2023-02-20 23:15

Modified

2026-05-20 14:56

Summary

Details

An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.

Severity

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

7.3 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2022-48338	REPORT
	https://www.cve.org/CVERecord?id=CVE-2022-48338	REPORT
	https://ubuntu.com/security/notices/USN-7027-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.22-14ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.22-14ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.22-4ubuntu3",
        "21.4.22-14ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-5ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-5ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-4ubuntu1",
        "21.4.24-5ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-9?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-8build1",
        "21.4.24-9"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-4",
        "2009.02.17.dfsg.2-5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:27.1+1-3ubuntu5.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:27.1+1-3ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:27.1+1-3ubuntu3",
        "1:27.1+1-3ubuntu5",
        "1:27.1+1-3ubuntu5.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-9ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-9ubuntu2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-9ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12",
        "21.4.24-12build2",
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-2",
        "2009.02.17.dfsg.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-3",
        "2009.02.17.dfsg.3-3build1"
      ]
    }
  ],
  "aliases": [],
  "details": "An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.",
  "id": "UBUNTU-CVE-2022-48338",
  "modified": "2026-05-20T14:56:21Z",
  "published": "2023-02-20T23:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48338"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48338"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7027-1"
    }
  ],
  "related": [
    "USN-7027-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2022-48338"
  ]
}

CVE-2022-48338 (GCVE-0-2022-48338)

Vulnerability from cvelistv5 – Published: 2023-02-20 00:00 – Updated: 2025-03-18 15:21

Summary

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

mitre

References

4 references

URL	Tags
https://git.savannah.gnu.org/cgit/emacs.git/commi…
https://www.debian.org/security/2023/dsa-5360	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisory

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:10:59.720Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c"
          },
          {
            "name": "DSA-5360",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5360"
          },
          {
            "name": "FEDORA-2023-5763445abe",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/"
          },
          {
            "name": "FEDORA-2023-29df561f1d",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-48338",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-18T15:21:17.361535Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-77",
                "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T15:21:22.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-14T02:06:10.519Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=9a3b08061feea14d6f37685ca1ab8801758bfd1c"
        },
        {
          "name": "DSA-5360",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.debian.org/security/2023/dsa-5360"
        },
        {
          "name": "FEDORA-2023-5763445abe",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6HDBUQNAH2WL4MHWCTUZLN7NGF7CHTK/"
        },
        {
          "name": "FEDORA-2023-29df561f1d",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FLPQ4K6H2S5TY3L5UDN4K4B3L5RQJYQ6/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-48338",
    "datePublished": "2023-02-20T00:00:00.000Z",
    "dateReserved": "2023-02-20T00:00:00.000Z",
    "dateUpdated": "2025-03-18T15:21:22.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-7027-1

Vulnerability from osv_ubuntu

Published

2024-09-19 17:16

Modified

2026-06-25 10:46

Summary

emacs, emacs24, emacs25 vulnerabilities

Details

It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45939)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48339)

It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204, CVE-2024-30205)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2024-39331)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7027-1	ADVISORY
	https://ubuntu.com/security/CVE-2022-45939	REPORT
	https://ubuntu.com/security/CVE-2022-48337	REPORT
	https://ubuntu.com/security/CVE-2022-48338	REPORT
	https://ubuntu.com/security/CVE-2022-48339	REPORT
	https://ubuntu.com/security/CVE-2023-28617	REPORT
	https://ubuntu.com/security/CVE-2024-30203	REPORT
	https://ubuntu.com/security/CVE-2024-30204	REPORT
	https://ubuntu.com/security/CVE-2024-30205	REPORT
	https://ubuntu.com/security/CVE-2024-39331	REPORT
	https://launchpad.net/bugs/2070418	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs24",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-bin-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-el",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-lucid",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-nox",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "emacs24",
        "purl": "pkg:deb/ubuntu/emacs24@24.5+1-6ubuntu1.1+esm4?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.5+1-6ubuntu1.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.5+1-1ubuntu2",
        "24.5+1-1ubuntu4",
        "24.5+1-1ubuntu5",
        "24.5+1-1ubuntu6",
        "24.5+1-1ubuntu7",
        "24.5+1-6ubuntu1",
        "24.5+1-6ubuntu1.1",
        "24.5+1-6ubuntu1.1+esm1",
        "24.5+1-6ubuntu1.1+esm2",
        "24.5+1-6ubuntu1.1+esm3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs25",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-bin-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-el",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-lucid",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-nox",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "emacs25",
        "purl": "pkg:deb/ubuntu/emacs25@25.2+1-6ubuntu0.1~esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.2+1-6ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "25.2+1-6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:26.3+1-1ubuntu2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:26.3+1-1ubuntu2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:26.3+1-1ubuntu1",
        "1:26.3+1-1ubuntu2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48338",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:27.1+1-3ubuntu5.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:27.1+1-3ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:27.1+1-3ubuntu3",
        "1:27.1+1-3ubuntu5",
        "1:27.1+1-3ubuntu5.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-pgtk",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:29.3+1-1ubuntu2+esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:29.3+1-1ubuntu2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:29.1+1-5ubuntu1",
        "1:29.2+1-1ubuntu1",
        "1:29.2+1-2ubuntu4",
        "1:29.3+1-1ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-45939)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-48337)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-48339)\n\nIt was discovered that Emacs incorrectly handled filename sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2023-28617)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to crash the program, resulting in\na denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203,\nCVE-2024-30204, CVE-2024-30205)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to execute arbitrary commands.\n(CVE-2024-39331)\n",
  "id": "USN-7027-1",
  "modified": "2026-06-25T10:46:30Z",
  "published": "2024-09-19T17:16:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7027-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-45939"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48337"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48338"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48339"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30204"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30205"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39331"
    },
    {
      "type": "REPORT",
      "url": "https://launchpad.net/bugs/2070418"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "emacs, emacs24, emacs25 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2022-45939",
    "UBUNTU-CVE-2022-48337",
    "UBUNTU-CVE-2022-48338",
    "UBUNTU-CVE-2022-48339",
    "UBUNTU-CVE-2023-28617",
    "UBUNTU-CVE-2024-30203",
    "UBUNTU-CVE-2024-30204",
    "UBUNTU-CVE-2024-30205",
    "UBUNTU-CVE-2024-39331"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2022-48338

Vulnerability from osv_ubuntu

CVE-2022-48338 (GCVE-0-2022-48338)

usn-7027-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature