CVE-2024-30204

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.(CVE-2024-30204)

In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.(CVE-2024-30205)

In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

• CVE-2024-30204: disable LaTeX preview for e-mail attachments to protection when untrusted-content is non-nil

In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23. (CVE-2024-30202) In Emacs before 29.3, Gnus treats inline MIME contents as trusted. (CVE-2024-30203) In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments. (CVE-2024-30204) In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23. (CVE-2024-30205)

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

• emacs: Gnus treats inline MIME contents as trusted (CVE-2024-30203)

• emacs: LaTeX preview is enabled by default for e-mail attachments (CVE-2024-30204)

• emacs: Org mode considers contents of remote files to be trusted (CVE-2024-30205)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

This update for emacs fixes the following issues:

• CVE-2024-30203: Fixed treating inline MIME contents as trusted (bsc#1222053)
• CVE-2024-30204: Fixed LaTeX preview enabled by default for e-mail attachments (bsc#1222052)
• CVE-2024-30205: Fixed Org mode considering contents of remote files as trusted (bsc#1222050)

This update for emacs fixes the following issues:

• CVE-2024-30203: Fixed denial of service via MIME contents (bsc#1222053)
• CVE-2024-30204: Fixed denial of service via LaTeX preview in e-mail attachments (bsc#1222052)
• CVE-2024-30205: Fixed Org mode considering contents of remote files as trusted (bsc#1222050)

This update for emacs fixes the following issues:

• CVE-2024-30203: Fixed denial of service via MIME contents (bsc#1222053).
• CVE-2024-30204: Fixed denial of service via LaTeX preview in e-mail attachments (bsc#1222052).
• CVE-2024-30204: Fixed Org mode considers contents of remote files to be trusted (bsc#1222050).
• CVE-2024-39331: Fixed evaluation of arbitrary unsafe Elisp code in Org mode (bsc#1226957).

It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45939)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48339)

It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204, CVE-2024-30205)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2024-39331)