CVE-2024-39331

Emacs is the extensible, customizable, self-documenting real-time display editor. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp programming language with extensions to support text editing. And it is an entire ecosystem of functionality beyond text editing, including a project planner, mail and news reader, debugger interface, calendar, and more.

Security Fix(es):

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.(CVE-2024-39331)

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

• emacs: Gnus treats inline MIME contents as trusted (CVE-2024-30203)

• emacs: Org mode considers contents of remote files to be trusted (CVE-2024-30205)

• emacs: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

• emacs: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news.

Security Fix(es):

• emacs: Gnus treats inline MIME contents as trusted (CVE-2024-30203)
• emacs: Org mode considers contents of remote files to be trusted (CVE-2024-30205)
• emacs: org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

• CVE-2024-39331: do not expand link abbrevs that contain unsafe function

• CVE-2024-39331: fix org-link-expand-abbrev to not expand unsafe link abbreviations

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. (CVE-2024-39331)

These are all security issues fixed in the emacs-29.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the syft-1.42.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for syft fixes the following issues:

Changes in syft:

• Update to version 1.45.0:

  • Added Features
    • Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
    • MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
    • Catalog ingress-nginx binary [#4818 #4857 @witchcraze]
  • Bug Fixes
    • Support helm binary various versions [#4820 #4922 @witchcraze]
    • Support julia binary various versions [#4867 #4945 @witchcraze]
    • Support deno binary old versions [#4865 #4939 @witchcraze]
    • Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
    • Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
    • Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
    • Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
    • Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
    • Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
    • fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
    • Grype ignores python requirements in arbitrary equality (===) format [#4834 #4835 @cyphercodes]
    • valkey is detected as both of valkey and redis [#4591 #4619 @witchcraze]
    • TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#4837 #4848 @ChrisJr404]
  • Additional Changes
    • hoist name normalization regexp to package level [#4926 @matiasinsaurralde]
    • bump the actions-minor-patch group across 1 directory with 6 updates [#4946 @dependabot]
    • bump the actions-minor-patch group across 2 directories with 2 updates [#4936 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 4 updates [#4927 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 2 updates [#4920 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 2 updates [#4897 @dependabot]
    • update CPE dictionary index [#4831 @anchore-oss-update-bot]
  • Dependencies
    • chore(deps): bump github.com/containerd/containerd/v2 (#4935)
    • chore(deps): update anchore dependencies (#4821)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#4930)
    • chore(deps): update CPE dictionary index (#4925)
    • chore(deps): update CPE dictionary index (#4909)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#4911)

• Update to version 1.44.0:

  • Added Features
    • Add support for linux-riscv64 [#4757 @luhenry]
  • Bug Fixes
    • Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes]
    • Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze]
    • empty rockspec causes index out of range [#4824 #4827 @aki1770-del]
    • PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productversion [#4813 #4814 @rezmoss]
    • Syft safeCopy silently swallows archive decompression errors [#4806 #4807 @SAY-5]

• Update to version 1.43.0:

  • Added Features
    • added deno bin classifiers [#4677 @rezmoss]
    • Support haskell old versions [#3237 #4793 @witchcraze]
    • Add support for OpenLDAP binary detection [#4768 #4755 @nadimz]
    • Support erlang ols versions [#3235 #4766 @witchcraze]
  • Bug Fixes
    • improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel]
    • fix format string in search results struct [#4775 @willmurphyscode]
    • prevent infinite recursion in Document.UnmarshalJSON with encoding/json/v2 [#4748 @benja-M-1]
    • Syft can not complete scanning golang image [#4686]
    • javascript-package-cataloger drops entire package.json when authors/contributors/maintainers is a…

This update for emacs fixes the following issues:

• CVE-2024-39331: Fixed evaluation of arbitrary unsafe Elisp code in Org mode (bsc#1226957).

This update for emacs fixes the following issues:

• CVE-2024-30203: Fixed denial of service via MIME contents (bsc#1222053).
• CVE-2024-30204: Fixed denial of service via LaTeX preview in e-mail attachments (bsc#1222052).
• CVE-2024-30204: Fixed Org mode considers contents of remote files to be trusted (bsc#1222050).
• CVE-2024-39331: Fixed evaluation of arbitrary unsafe Elisp code in Org mode (bsc#1226957).

This update for emacs fixes the following issues:

• CVE-2024-39331: Fixed evaluation of arbitrary unsafe Elisp code in Org mode (bsc#1226957).

It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-45939)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48339)

It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204, CVE-2024-30205)

It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use this issue to execute arbitrary commands. (CVE-2024-39331)

It was discovered that Org Mode did not correctly handle filenames containing shell metacharacters. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-28617)

It was discovered that Org Mode could run untrusted code left in its buffer. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30202)

It was discovered that Org Mode did not correctly handle the contents of remote files. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-30205)

It was discovered that Org Mode could be made to run arbitrary Elisp code. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2024-39331)