Vulnerability-Lookup

ubuntu-cve-2023-28617

Vulnerability from osv_ubuntu

Published

2023-03-19 03:15

Modified

2026-05-20 15:02

Summary

Details

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2023-28617	REPORT
	https://list.orgmode.org/tencent_04CF842704737012…	REPORT
	https://git.savannah.gnu.org/cgit/emacs/org-mode.…	REPORT
	https://git.savannah.gnu.org/cgit/emacs/org-mode.…	REPORT
	https://list.orgmode.org/tencent_04CF842704737012…	REPORT
	https://ubuntu.com/security/notices/USN-6003-1	ADVISORY
	https://www.cve.org/CVERecord?id=CVE-2023-28617	REPORT
	https://ubuntu.com/security/notices/USN-7027-1	ADVISORY
	https://ubuntu.com/security/notices/USN-7375-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.22-14ubuntu1"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.22-14ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.22-14ubuntu1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.22-4ubuntu3",
        "21.4.22-14ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-2"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-2?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs24",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-bin-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-el",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-lucid",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-nox",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "emacs24",
        "purl": "pkg:deb/ubuntu/emacs24@24.5+1-6ubuntu1.1+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.5+1-6ubuntu1.1+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.5+1-1ubuntu2",
        "24.5+1-1ubuntu4",
        "24.5+1-1ubuntu5",
        "24.5+1-1ubuntu6",
        "24.5+1-1ubuntu7",
        "24.5+1-6ubuntu1",
        "24.5+1-6ubuntu1.1",
        "24.5+1-6ubuntu1.1+esm1",
        "24.5+1-6ubuntu1.1+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs25",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-bin-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-el",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-lucid",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-nox",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "emacs25",
        "purl": "pkg:deb/ubuntu/emacs25@25.2+1-6ubuntu0.1~esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.2+1-6ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "25.2+1-6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-5ubuntu1"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-5ubuntu1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-5ubuntu1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-4ubuntu1",
        "21.4.24-5ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-4"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-4?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-4"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:26.3+1-1ubuntu2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:26.3+1-1ubuntu2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:26.3+1-1ubuntu1",
        "1:26.3+1-1ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-9"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-9"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-9?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-8build1",
        "21.4.24-9"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-5?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-4",
        "2009.02.17.dfsg.2-5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:27.1+1-3ubuntu5.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:27.1+1-3ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:27.1+1-3ubuntu3",
        "1:27.1+1-3ubuntu5",
        "1:27.1+1-3ubuntu5.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-9ubuntu2"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-9ubuntu2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-9ubuntu2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-9ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.2-5"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.2-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.2-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.2-5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "elpa-org",
            "binary_version": "9.5.2+dfsh-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "org-mode",
            "binary_version": "9.5.2+dfsh-4ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@9.5.2+dfsh-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.5.2+dfsh-4ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.4.0+dfsg-1",
        "9.5.2+dfsh-1",
        "9.5.2+dfsh-2",
        "9.5.2+dfsh-3",
        "9.5.2+dfsh-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12",
        "21.4.24-12build2",
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-2",
        "2009.02.17.dfsg.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-bin",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-mule-canna-wnn",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-nomule",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-support",
            "binary_version": "21.4.24-12build3"
          },
          {
            "binary_name": "xemacs21-supportel",
            "binary_version": "21.4.24-12build3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "xemacs21",
        "purl": "pkg:deb/ubuntu/xemacs21@21.4.24-12build3?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "21.4.24-12build3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "xemacs21-basesupport",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-basesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-mulesupport",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          },
          {
            "binary_name": "xemacs21-mulesupport-el",
            "binary_version": "2009.02.17.dfsg.3-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "xemacs21-packages",
        "purl": "pkg:deb/ubuntu/xemacs21-packages@2009.02.17.dfsg.3-3build1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2009.02.17.dfsg.3-3",
        "2009.02.17.dfsg.3-3build1"
      ]
    }
  ],
  "aliases": [],
  "details": "org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.",
  "id": "UBUNTU-CVE-2023-28617",
  "modified": "2026-05-20T15:02:33Z",
  "published": "2023-03-19T03:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28617"
    },
    {
      "type": "REPORT",
      "url": "https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A%40qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e"
    },
    {
      "type": "REPORT",
      "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485"
    },
    {
      "type": "REPORT",
      "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741"
    },
    {
      "type": "REPORT",
      "url": "https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A@qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6003-1"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28617"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7027-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7375-1"
    }
  ],
  "related": [
    "USN-6003-1",
    "USN-7027-1",
    "USN-7375-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2023-28617"
  ]
}

CVE-2023-28617 (GCVE-0-2023-28617)

Vulnerability from cvelistv5 – Published: 2023-03-19 00:00 – Updated: 2025-11-03 20:35

Summary

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

n/a
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

mitre

References

6 references

URL	Tags
https://list.orgmode.org/tencent_04CF842704737012…
https://git.savannah.gnu.org/cgit/emacs/org-mode.…
https://git.savannah.gnu.org/cgit/emacs/org-mode.…
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://lists.debian.org/debian-lts-announce/2023…	mailing-list
https://lists.debian.org/debian-lts-announce/2025…

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:35:28.705Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A%40qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741"
          },
          {
            "name": "[debian-lts-announce] 20230509 [SECURITY] [DLA 3416-1] emacs security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html"
          },
          {
            "name": "[debian-lts-announce] 20231012 [SECURITY] [DLA 3616-1] org-mode security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00019.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00033.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-28617",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T15:37:14.308348Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-26T20:48:41.554Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-12T12:06:14.951Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://list.orgmode.org/tencent_04CF842704737012CCBCD63CD654DD41CA0A%40qq.com/T/#m6ef8e7d34b25fe17b4cbb655b161edce18c6655e"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485"
        },
        {
          "url": "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741"
        },
        {
          "name": "[debian-lts-announce] 20230509 [SECURITY] [DLA 3416-1] emacs security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/05/msg00008.html"
        },
        {
          "name": "[debian-lts-announce] 20231012 [SECURITY] [DLA 3616-1] org-mode security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00019.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-28617",
    "datePublished": "2023-03-19T00:00:00.000Z",
    "dateReserved": "2023-03-19T00:00:00.000Z",
    "dateUpdated": "2025-11-03T20:35:28.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

usn-6003-1

Vulnerability from osv_ubuntu

Published

2023-04-06 16:15

Modified

2026-06-25 10:46

Summary

emacs24 vulnerability

Details

Xi Lu discovered that Emacs did not properly handle certain inputs. An attacker could possibly use this issue to execute arbitrary commands.

References

URL

Type

	https://ubuntu.com/security/notices/USN-6003-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-28617	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs24",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-bin-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-el",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-lucid",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          },
          {
            "binary_name": "emacs24-nox",
            "binary_version": "24.5+1-6ubuntu1.1+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "emacs24",
        "purl": "pkg:deb/ubuntu/emacs24@24.5+1-6ubuntu1.1+esm3?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.5+1-6ubuntu1.1+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.5+1-1ubuntu2",
        "24.5+1-1ubuntu4",
        "24.5+1-1ubuntu5",
        "24.5+1-1ubuntu6",
        "24.5+1-1ubuntu7",
        "24.5+1-6ubuntu1",
        "24.5+1-6ubuntu1.1",
        "24.5+1-6ubuntu1.1+esm1",
        "24.5+1-6ubuntu1.1+esm2"
      ]
    }
  ],
  "aliases": [],
  "details": "Xi Lu discovered that Emacs did not properly handle certain\ninputs. An attacker could possibly use this issue to execute\narbitrary commands.\n",
  "id": "USN-6003-1",
  "modified": "2026-06-25T10:46:12Z",
  "published": "2023-04-06T16:15:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6003-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28617"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "emacs24 vulnerability",
  "upstream": [
    "UBUNTU-CVE-2023-28617"
  ]
}

usn-7027-1

Vulnerability from osv_ubuntu

Published

2024-09-19 17:16

Modified

2026-06-25 10:46

Summary

emacs, emacs24, emacs25 vulnerabilities

Details

It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45939)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48339)

It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204, CVE-2024-30205)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2024-39331)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7027-1	ADVISORY
	https://ubuntu.com/security/CVE-2022-45939	REPORT
	https://ubuntu.com/security/CVE-2022-48337	REPORT
	https://ubuntu.com/security/CVE-2022-48338	REPORT
	https://ubuntu.com/security/CVE-2022-48339	REPORT
	https://ubuntu.com/security/CVE-2023-28617	REPORT
	https://ubuntu.com/security/CVE-2024-30203	REPORT
	https://ubuntu.com/security/CVE-2024-30204	REPORT
	https://ubuntu.com/security/CVE-2024-30205	REPORT
	https://ubuntu.com/security/CVE-2024-39331	REPORT
	https://launchpad.net/bugs/2070418	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs24",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-bin-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-common",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-el",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-lucid",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          },
          {
            "binary_name": "emacs24-nox",
            "binary_version": "24.5+1-6ubuntu1.1+esm4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "emacs24",
        "purl": "pkg:deb/ubuntu/emacs24@24.5+1-6ubuntu1.1+esm4?arch=source\u0026distro=esm-infra/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.5+1-6ubuntu1.1+esm4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "24.5+1-1ubuntu2",
        "24.5+1-1ubuntu4",
        "24.5+1-1ubuntu5",
        "24.5+1-1ubuntu6",
        "24.5+1-1ubuntu7",
        "24.5+1-6ubuntu1",
        "24.5+1-6ubuntu1.1",
        "24.5+1-6ubuntu1.1+esm1",
        "24.5+1-6ubuntu1.1+esm2",
        "24.5+1-6ubuntu1.1+esm3"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs25",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-bin-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-common",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-el",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-lucid",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          },
          {
            "binary_name": "emacs25-nox",
            "binary_version": "25.2+1-6ubuntu0.1~esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "emacs25",
        "purl": "pkg:deb/ubuntu/emacs25@25.2+1-6ubuntu0.1~esm2?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "25.2+1-6ubuntu0.1~esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "25.2+1-6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:26.3+1-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:26.3+1-1ubuntu2+esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:26.3+1-1ubuntu2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:26.3+1-1ubuntu1",
        "1:26.3+1-1ubuntu2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2022-45939",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48337",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48338",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2022-48339",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30203",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:27.1+1-3ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:27.1+1-3ubuntu5.2?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:27.1+1-3ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:27.1+1-3ubuntu3",
        "1:27.1+1-3ubuntu5",
        "1:27.1+1-3ubuntu5.1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "emacs",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-bin-common",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-common",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-el",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-gtk",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-lucid",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-nox",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          },
          {
            "binary_name": "emacs-pgtk",
            "binary_version": "1:29.3+1-1ubuntu2+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "emacs",
        "purl": "pkg:deb/ubuntu/emacs@1:29.3+1-1ubuntu2+esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:29.3+1-1ubuntu2+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:29.1+1-5ubuntu1",
        "1:29.2+1-1ubuntu1",
        "1:29.2+1-2ubuntu4",
        "1:29.3+1-1ubuntu2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-45939)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS\nand Ubuntu 22.04 LTS. (CVE-2022-48337)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)\n\nXi Lu discovered that Emacs incorrectly handled input sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2022-48339)\n\nIt was discovered that Emacs incorrectly handled filename sanitization. An\nattacker could possibly use this issue to execute arbitrary commands. This\nissue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04\nLTS. (CVE-2023-28617)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to crash the program, resulting in\na denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203,\nCVE-2024-30204, CVE-2024-30205)\n\nIt was discovered that Emacs incorrectly handled certain crafted files. An\nattacker could possibly use this issue to execute arbitrary commands.\n(CVE-2024-39331)\n",
  "id": "USN-7027-1",
  "modified": "2026-06-25T10:46:30Z",
  "published": "2024-09-19T17:16:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7027-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-45939"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48337"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48338"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2022-48339"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30203"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30204"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30205"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39331"
    },
    {
      "type": "REPORT",
      "url": "https://launchpad.net/bugs/2070418"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "emacs, emacs24, emacs25 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2022-45939",
    "UBUNTU-CVE-2022-48337",
    "UBUNTU-CVE-2022-48338",
    "UBUNTU-CVE-2022-48339",
    "UBUNTU-CVE-2023-28617",
    "UBUNTU-CVE-2024-30203",
    "UBUNTU-CVE-2024-30204",
    "UBUNTU-CVE-2024-30205",
    "UBUNTU-CVE-2024-39331"
  ]
}

usn-7375-1

Vulnerability from osv_ubuntu

Published

2025-03-27 00:41

Modified

2026-06-25 10:46

Summary

org-mode vulnerabilities

Details

It was discovered that Org Mode did not correctly handle filenames containing shell metacharacters. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Org Mode could run untrusted code left in its buffer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)

It was discovered that Org Mode did not correctly handle the contents of remote files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30205)

It was discovered that Org Mode could be made to run arbitrary Elisp code. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-39331)

References

URL

Type

	https://ubuntu.com/security/notices/USN-7375-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-28617	REPORT
	https://ubuntu.com/security/CVE-2024-30202	REPORT
	https://ubuntu.com/security/CVE-2024-30205	REPORT
	https://ubuntu.com/security/CVE-2024-39331	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "org-mode",
            "binary_version": "8.3.3-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@8.3.3-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.3.3-2ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "8.2.10-1",
        "8.3.1-2",
        "8.3.2-1",
        "8.3.3-1",
        "8.3.3-2"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "elpa-org",
            "binary_version": "9.1.6+dfsg-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "org-mode",
            "binary_version": "9.1.6+dfsg-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@9.1.6+dfsg-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.1.6+dfsg-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.0.9+dfsg-3",
        "9.1.2+dfsg-2",
        "9.1.5+dfsg-1",
        "9.1.6+dfsg-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "elpa-org",
            "binary_version": "9.3.1+dfsg-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "org-mode",
            "binary_version": "9.3.1+dfsg-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@9.3.1+dfsg-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.3.1+dfsg-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.2.3+dfsg-1",
        "9.3+dfsg-1",
        "9.3+dfsg-2",
        "9.3.1+dfsg-1"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-28617",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30202",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "elpa-org",
            "binary_version": "9.5.2+dfsh-4ubuntu0.1~esm1"
          },
          {
            "binary_name": "org-mode",
            "binary_version": "9.5.2+dfsh-4ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@9.5.2+dfsh-4ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.5.2+dfsh-4ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.4.0+dfsg-1",
        "9.5.2+dfsh-1",
        "9.5.2+dfsh-2",
        "9.5.2+dfsh-3",
        "9.5.2+dfsh-4"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-30202",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-30205",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39331",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "elpa-org",
            "binary_version": "9.6.10+dfsg-1ubuntu0.1~esm1"
          },
          {
            "binary_name": "org-mode",
            "binary_version": "9.6.10+dfsg-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "org-mode",
        "purl": "pkg:deb/ubuntu/org-mode@9.6.10+dfsg-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.6.10+dfsg-1ubuntu0.1~esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "9.6.7+dfsg-1",
        "9.6.10+dfsg-1"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Org Mode did not correctly handle filenames\ncontaining shell metacharacters. An attacker could possibly use this issue\nto cause a denial of service or execute arbitrary code. This issue only\naffected Ubuntu 22.04 LTS. (CVE-2023-28617)\n\nIt was discovered that Org Mode could run untrusted code left in its\nbuffer. An attacker could possibly use this issue to cause a denial of\nservice or execute arbitrary code. This issue only affected\nUbuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)\n\nIt was discovered that Org Mode did not correctly handle the contents of\nremote files. An attacker could possibly use this issue to cause a denial\nof service or execute arbitrary code. This issue only affected\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.\n(CVE-2024-30205)\n\nIt was discovered that Org Mode could be made to run arbitrary Elisp code.\nAn attacker could possibly use this issue to cause a denial of service or\nexecute arbitrary code. (CVE-2024-39331)\n",
  "id": "USN-7375-1",
  "modified": "2026-06-25T10:46:42Z",
  "published": "2025-03-27T00:41:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-7375-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-28617"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30202"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-30205"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39331"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "org-mode vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-28617",
    "UBUNTU-CVE-2024-30202",
    "UBUNTU-CVE-2024-30205",
    "UBUNTU-CVE-2024-39331"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2023-28617

Vulnerability from osv_ubuntu

CVE-2023-28617 (GCVE-0-2023-28617)

usn-6003-1

Vulnerability from osv_ubuntu

usn-7027-1

Vulnerability from osv_ubuntu

usn-7375-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature