A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0098 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-2491:
      A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the org-     babel-execute:latex function in ob-latex.el can result in arbitrary command execution. This CVE exists     because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and     Red Hat Enterprise Linux 9.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0154 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2022-48337:
    GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input.

    CVE-2022-48338:
    An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed.

    CVE-2022-48339:
    An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed.

    CVE-2023-2491:
    A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the org-     babel-execute:latex function in ob-latex.el can result in arbitrary command execution. This CVE exists     because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and     Red Hat Enterprise Linux 9.2.

    CVE-2023-28617:
    org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute     arbitrary commands via a file name or directory name that contains shell metacharacters.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3104 advisory.

    [1:26.1-10.2]
    - Bump release

    [1:26.1-10.1]
    - Bump release

    [1:26.1-10]
    - Fix ob-latex.el command injection vulnerability (#2180586)

    [1:26.1-9]
    - Fix MH-E mail composition with GNU Mailutils (#1991156)

    [1:26.1-8]
    - Fix ctags local command execute vulnerability (#2149386)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:3104 advisory.

  - A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the org-     babel-execute:latex function in ob-latex.el can result in arbitrary command execution. This CVE exists     because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and     Red Hat Enterprise Linux 9.2. (CVE-2023-2491)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:3104 advisory.

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing     features, a scripting language (elisp), and the capability to read e-mail and news.

    Security Fix(es):

    * emacs: Regression of CVE-2023-28617 fixes in the Red Hat Enterprise Linux (CVE-2023-2491)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2626 advisory.

    [1:27.2-8.1]
    - Fix etags local command injection vulnerability (#2184369)
    - Fix htmlfontify.el command injection vulnerability (#2184368)
    - Fix ruby-mode.el local command injection vulnerability (#2184367)
    - Fix ob-latex.el command injection vulnerability (#2184377)

    [1:27.2-8]
    - Use a 64KB page size for pdump (#1979804)

    [1:27.2-7]
    - Fix ctags local command execute vulnerability (#2149387)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2626 advisory.

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

  - A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the org-     babel-execute:latex function in ob-latex.el can result in arbitrary command execution. This CVE exists     because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and     Red Hat Enterprise Linux 9.2. (CVE-2023-2491)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2626 advisory.

    GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing     features, a scripting language (elisp), and the capability to read e-mail and news.

    Security Fix(es):

    * emacs: Regression of CVE-2023-28617 fixes in the Red Hat Enterprise Linux (CVE-2023-2491)

    * emacs: command execution via shell metacharacters (CVE-2022-48337)

    * emacs: local command injection in ruby-mode.el (CVE-2022-48338)

    * emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276254	TencentOS Server 3: emacs (TSSA-2023:0098)	Nessus	Tencent Local Security Checks	high
236068	Alibaba Cloud Linux 3 : 0154: emacs (ALINUX3-SA-2023:0154)	Nessus	Alibaba Cloud Linux Local Security Checks	critical
176359	Oracle Linux 8 : emacs (ELSA-2023-3104)	Nessus	Oracle Linux Local Security Checks	high
176130	AlmaLinux 8 : emacs (ALSA-2023:3104)	Nessus	Alma Linux Local Security Checks	high
175880	RHEL 8 : emacs (RHSA-2023:3104)	Nessus	Red Hat Local Security Checks	high
175711	Oracle Linux 9 : emacs (ELSA-2023-2626)	Nessus	Oracle Linux Local Security Checks	critical
175659	AlmaLinux 9 : emacs (ALSA-2023:2626)	Nessus	Alma Linux Local Security Checks	critical
175437	RHEL 9 : emacs (RHSA-2023:2626)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2023-2491

high

Tenable Plugins

high

critical

high

high

high

critical

critical

critical