The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7027-1 advisory.

    It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2022-45939)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2022-48339)

    It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use     this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2023-28617)

    It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use     this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04     LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204,     CVE-2024-30205)

    It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use     this issue to execute arbitrary commands. (CVE-2024-39331)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-cbc71cc4fe advisory.

    Automatic update for emacs-28.2-1.fc38.

    ##### **Changelog**

    ```
    * Tue Nov  1 2022 Dan ermk <dan.cermak@cgc-instruments.com> - 1:28.2-1
    - New upstream release 28.2, fixes rhbz#2126048
    - Add patch to fix CVE-2022-45939, fixes rhbz#2149381
    - spawn native-compilation processes with -Q rhbz#2155824 (petersen)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the emacs package has been released.

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-e37f239f2e advisory.

    Update to Emacs 28.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5314 advisory.

    It was discovered that missing input sanitising in the ctags functionality of Emacs may result in the     execution of arbitrary shell commands. For the stable distribution (bullseye), this problem has been fixed     in version 1:27.1+1-3.1+deb11u1. We recommend that you upgrade your emacs packages. For the detailed     security status of emacs please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/emacs

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-d69c7f95a4 advisory.

    Update to Emacs 28.2

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the emacs packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     ctags program. For example, a victim may use the 'ctags *' command (suggested in the ctags documentation)     in a situation where the current working directory has contents that depend on untrusted input.
    (CVE-2022-45939)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5781-1 advisory.

    It was discovered that Emacs did not properly manage certain inputs. An attacker could possibly use this     issue to execute arbitrary commands.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
207478	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Emacs vulnerabilities (USN-7027-1)	Nessus	Ubuntu Local Security Checks	9/19/2024	9/3/2025	critical
211020	Fedora 38 : emacs (2022-cbc71cc4fe)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	high
204227	Photon OS 5.0: Emacs PHSA-2023-5.0-0010	Nessus	PhotonOS Local Security Checks	7/24/2024	10/13/2026	critical
169833	Fedora 36 : emacs (2022-e37f239f2e)	Nessus	Fedora Local Security Checks	1/11/2023	11/14/2024	high
169946	Debian DSA-5314-1 : emacs - security update	Nessus	Debian Local Security Checks	1/12/2023	1/24/2025	high
211142	Fedora 37 : emacs (2022-d69c7f95a4)	Nessus	Fedora Local Security Checks	11/14/2024	11/14/2024	high
188915	EulerOS Virtualization 3.0.6.6 : emacs (EulerOS-SA-2023-3397)	Nessus	Huawei Local Security Checks	1/16/2024	1/16/2024	high
168744	Ubuntu 16.04 ESM : Emacs vulnerability (USN-5781-1)	Nessus	Ubuntu Local Security Checks	12/14/2022	8/27/2024	high

Detections

Analytics

Plugins Search

critical

high

critical

high

high

high

high

high