CVE-2017-14482
Fixed in a distro release EPSS 4%
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
Products: gnu emacs, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 7 | emacs23 | 23.4+1-4+deb7u1 |
| Debian 8 | emacs24 | 24.4+1-5+deb8u1 |
| Debian 9 | emacs24 | 24.5+1-11+deb9u1 |
| Debian 9 | emacs25 | 25.1+1-4+deb9u1 |
| Red Hat Enterprise Linux 7 | emacs | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-common | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-debuginfo | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-el | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-filesystem | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-nox | 1:24.3-20.el7_4 |
| Red Hat Enterprise Linux 7 | emacs-terminal | 1:24.3-20.el7_4 |
| SUSE Linux Enterprise Desktop 12 SP2 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | emacs | 22.3-42.3.1 |
| SUSE Linux Enterprise Server 11 SP3-LTSS | emacs | 22.3-42.3.1 |
| SUSE Linux Enterprise Server 11 SP3-TERADATA | emacs | 22.3-42.3.1 |
| SUSE Linux Enterprise Server 11 SP4 | emacs | 22.3-42.3.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server 12 SP2 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server 12 SP3 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server 12-LTSS | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | emacs | 22.3-42.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | emacs | 24.3-25.3.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | emacs | 22.3-42.3.1 |
| SUSE OpenStack Cloud 6 | emacs | 24.3-25.3.1 |
| Ubuntu 14.04 LTS | emacs24 | 24.3+1-2ubuntu1.1 |
| Ubuntu 16.04 LTS | emacs24 | 24.5+1-6ubuntu1.1 |