* bsc#1237091 Cross-References: * CVE-2025-1244 . # Security update for emacs Announcement ID: SUSE-SU-2025:0599-1 Release Date: 2025-02-19T16:09:36Z Rating: important References: * bsc#1237091 Cross-References: * CVE-2025-1244 CVSS scores: * CVE-2025-1244 ( SUSE ): 7.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N * CVE-2025-1244 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2025-1244 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * Basesystem Module 15-SP6 * Desktop Applications Module 15-SP6 * openSUSE Leap 15.4 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves one vulnerability can now be installed. ## Description: This update for emacs fixes the following issues: * CVE-2025-1244: improper handling of custom "man" URI schemes allow for shell command injections. (bsc#1237091) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run thecommand listed for your product: * openSUSE Leap 15.4 zypper in -t patch SUSE-2025-599=1 * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-599=1 * Basesystem Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-599=1 * Desktop Applications Module 15-SP6 zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP6-2025-599=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-599=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-599=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-599=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-599=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-599=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-599=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-599=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-599=1 * SUSE Manager Proxy 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-599=1 * SUSE Manager Retail Branch Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch- Server-4.3-2025-599=1 * SUSE Manager Server 4.3 zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-599=1 ## Package List: * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 *emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * openSUSE Leap 15.4 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * openSUSE Leap 15.6 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * Basesystem Module 15-SP6 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * Desktop Applications Module 15-SP6 (aarch64 ppc64le s390x x86_64) * emacs-x11-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 *SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-x11-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-x11-debuginfo-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Manager Proxy 4.3 (x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 *etags-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Manager Proxy 4.3 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Manager Retail Branch Server 4.3 (x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Manager Retail Branch Server 4.3 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 * SUSE Manager Server 4.3 (ppc64le s390x x86_64) * emacs-nox-debuginfo-27.2-150400.3.23.2 * emacs-debugsource-27.2-150400.3.23.2 * etags-27.2-150400.3.23.2 * emacs-debuginfo-27.2-150400.3.23.2 * etags-debuginfo-27.2-150400.3.23.2 * emacs-27.2-150400.3.23.2 * emacs-nox-27.2-150400.3.23.2 * SUSE Manager Server 4.3 (noarch) * emacs-el-27.2-150400.3.23.2 * emacs-info-27.2-150400.3.23.2 ## References: * https://www.suse.com/security/cve/CVE-2025-1244.html * https://bugzilla.suse.com/show_bug.cgi?id=1237091 . Important Emacs revision for SUSE tackles command exploitation vulnerability. Discover installation instructions and impacted versions.. SUSE Linux, emacs update, command injection mitigation. . Severity: Important. LinuxSecurity.com Team
An update for emacs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: emacs security update Advisory ID: RHSA-2023:1930-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:1930 Issue date: 2023-04-24 CVE Names: CVE-2023-28617 ==================================================================== 1. Summary: An update for emacs is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 8) - noarch 3. Description: GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language (elisp), and the capability to read e-mail and news. Security Fix(es): * emacs: command injection vulnerability in org-mode (CVE-2023-28617) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 2180544 - CVE-2023-28617 emacs:command injection vulnerability in org-mode 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): aarch64: emacs-26.1-7.el8_7.1.aarch64.rpm emacs-common-26.1-7.el8_7.1.aarch64.rpm emacs-common-debuginfo-26.1-7.el8_7.1.aarch64.rpm emacs-debuginfo-26.1-7.el8_7.1.aarch64.rpm emacs-debugsource-26.1-7.el8_7.1.aarch64.rpm emacs-lucid-26.1-7.el8_7.1.aarch64.rpm emacs-lucid-debuginfo-26.1-7.el8_7.1.aarch64.rpm emacs-nox-26.1-7.el8_7.1.aarch64.rpm emacs-nox-debuginfo-26.1-7.el8_7.1.aarch64.rpm noarch: emacs-terminal-26.1-7.el8_7.1.noarch.rpm ppc64le: emacs-26.1-7.el8_7.1.ppc64le.rpm emacs-common-26.1-7.el8_7.1.ppc64le.rpm emacs-common-debuginfo-26.1-7.el8_7.1.ppc64le.rpm emacs-debuginfo-26.1-7.el8_7.1.ppc64le.rpm emacs-debugsource-26.1-7.el8_7.1.ppc64le.rpm emacs-lucid-26.1-7.el8_7.1.ppc64le.rpm emacs-lucid-debuginfo-26.1-7.el8_7.1.ppc64le.rpm emacs-nox-26.1-7.el8_7.1.ppc64le.rpm emacs-nox-debuginfo-26.1-7.el8_7.1.ppc64le.rpm s390x: emacs-26.1-7.el8_7.1.s390x.rpm emacs-common-26.1-7.el8_7.1.s390x.rpm emacs-common-debuginfo-26.1-7.el8_7.1.s390x.rpm emacs-debuginfo-26.1-7.el8_7.1.s390x.rpm emacs-debugsource-26.1-7.el8_7.1.s390x.rpm emacs-lucid-26.1-7.el8_7.1.s390x.rpm emacs-lucid-debuginfo-26.1-7.el8_7.1.s390x.rpm emacs-nox-26.1-7.el8_7.1.s390x.rpm emacs-nox-debuginfo-26.1-7.el8_7.1.s390x.rpm x86_64: emacs-26.1-7.el8_7.1.x86_64.rpm emacs-common-26.1-7.el8_7.1.x86_64.rpm emacs-common-debuginfo-26.1-7.el8_7.1.x86_64.rpm emacs-debuginfo-26.1-7.el8_7.1.x86_64.rpm emacs-debugsource-26.1-7.el8_7.1.x86_64.rpm emacs-lucid-26.1-7.el8_7.1.x86_64.rpm emacs-lucid-debuginfo-26.1-7.el8_7.1.x86_64.rpm emacs-nox-26.1-7.el8_7.1.x86_64.rpm emacs-nox-debuginfo-26.1-7.el8_7.1.x86_64.rpm Red Hat Enterprise Linux BaseOS (v. 8): Source: emacs-26.1-7.el8_7.1.src.rpm noarch: emacs-filesystem-26.1-7.el8_7.1.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2023-28617 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBZEYnQdzjgjWX9erEAQgYZBAAk1j91NDn4D4TtEIZUN/O7x/nUtgn/HNX NT9NGe4VIlNmDlLbo2oN2QHN+a6UB3cDMU5zuY/GsxulwbKq+NbSXlcib5X8QG91 YNSJt0lhIZkATQKLetcS8+sfIS3I03cLJVTeTFzll/yjVhQl9loKrDE9XO0TO7MG mkfwMCPSj7SZe8BMKPQKVQ0lxrTrZ6+OcTsTmh7v6KtuwoR2ekqzdHKbWkcaFPlA R/XvN6HwVD10jTbQXoN9p5576TAEHynJ0BkyqtaGs7cNQeGd3deFDjOj/rTdrs7I bVrfpgO7MAuHXj6gnIILghLRSNIwEABmiQlT67+9p1z/zrhhkWU4Cjy3Xe8v5sXl jctLAHnqz0Eds+5vGp8L+uPfyXjrEoGGtVGO3ruJPcf7UqufSkkOKJHt28fmJwgW dnIAXKy3Fdg15b06Dc50QvYEFNkkYU801IgWFZb75PcNr6nLluO6KZwteCJO8w7r DP44IubEiri4VMkYxk3KTwZk6IjKdpGcoyDLy7FANHbGarbYDctmxlw7OY10ygck Ewt6nzD52qgwyt5q7CCpH/KYa96uJXAugmkUiEwQHeHZakMq2yyiXrxg7b1Gg88o ttZSL2pdeYg4oNs3bU6A5GrSP57zGWEYY++1zbJCew9EKdBAnJw5vqRsq6x/JBQc 6Wk6g1DQ26M=u1kk -----END PGP SIGNATURE----- -- RHSA-announce mailing list
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working . MGASA-2022-0457 - Updated emacs packages fix security vulnerability Publication date: 13 Dec 2022 URL: https://advisories.mageia.org/MGASA-2022-0457.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-45939 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. (CVE-2022-45939) References: - https://bugs.mageia.org/show_bug.cgi?id=31211 - https://lists.suse.com/pipermail/sle-security-updates/2022-December/013180.html - - https://www.cve.org/CVERecord?id=CVE-2022-45939 SRPMS: - 8/core/emacs-27.1-1.2.mga8 . Fedora enhances gedit to address file handling vulnerability using input sanitization, bolstering overall safety.. Emacs Security,Mageia Update,Command Execution Risk,Shell Metacharacters,Software Vulnerability. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.