CVE-2022-48337
Fixed in a distro release EPSS 2%CVSS 9.8
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Products: gnu emacs, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | emacs | 1:26.1-11.el8 |
| AlmaLinux 8 | emacs-common | 1:26.1-11.el8 |
| AlmaLinux 8 | emacs-filesystem | 1:26.1-11.el8 |
| AlmaLinux 8 | emacs-lucid | 1:26.1-11.el8 |
| AlmaLinux 8 | emacs-nox | 1:26.1-11.el8 |
| AlmaLinux 8 | emacs-terminal | 1:26.1-11.el8 |
| AlmaLinux 9 | emacs | 1:27.2-8.el9_2.1 |
| AlmaLinux 9 | emacs-common | 1:27.2-8.el9_2.1 |
| AlmaLinux 9 | emacs-filesystem | 1:27.2-8.el9_2.1 |
| AlmaLinux 9 | emacs-lucid | 1:27.2-8.el9_2.1 |
| AlmaLinux 9 | emacs-nox | 1:27.2-8.el9_2.1 |
| Amazon Linux 2 | emacs | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-common | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-devel | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-filesystem | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-lucid | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-nox | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2 | emacs-terminal | 1:27.2-4.amzn2.0.3 |
| Amazon Linux 2023 | emacs | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-common | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-devel | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-filesystem | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-lucid | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-nox | 1:28.2-3.amzn2023.0.3 |
| Amazon Linux 2023 | emacs-terminal | 1:28.2-3.amzn2023.0.3 |
| Debian 10 | emacs | 1:26.1+1-3.2+deb10u4 |
| Debian 11 | emacs | 1:27.1+1-3.1+deb11u2 |
| Debian 12 | emacs | 1:28.2+1-11 |
| Debian 13 | emacs | 1:28.2+1-11 |
| Debian 14 | emacs | 1:28.2+1-11 |
| Red Hat Enterprise Linux 8 | emacs | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-common | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-common-debuginfo | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-debuginfo | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-debugsource | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-filesystem | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-lucid | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-lucid-debuginfo | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-nox | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-nox-debuginfo | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 8 | emacs-terminal | 1:26.1-11.el8 |
| Red Hat Enterprise Linux 9 | emacs | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-common | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-common-debuginfo | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-debuginfo | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-debugsource | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-filesystem | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-lucid | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-lucid-debuginfo | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-nox | 1:27.2-8.el9_2.1 |
| Red Hat Enterprise Linux 9 | emacs-nox-debuginfo | 1:27.2-8.el9_2.1 |
| Red Hat rhel eus 8.6 | emacs | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-common | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-common-debuginfo | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-debuginfo | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-debugsource | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-filesystem | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-lucid | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-lucid-debuginfo | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-nox | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-nox-debuginfo | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.6 | emacs-terminal | 1:26.1-7.el8_6.3 |
| Red Hat rhel eus 8.8 | emacs | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-common | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-common-debuginfo | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-debuginfo | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-debugsource | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-filesystem | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-lucid | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-lucid-debuginfo | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-nox | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-nox-debuginfo | 1:26.1-10.el8_8.4 |
| Red Hat rhel eus 8.8 | emacs-terminal | 1:26.1-10.el8_8.4 |
| Rocky Linux 8 | emacs | 1:26.1-11.el8 |
| SUSE Enterprise Storage 7 | emacs | 25.3-150000.3.15.1 |
| SUSE Enterprise Storage 7.1 | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP4 | emacs | 27.2-150400.3.6.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP4 | emacs | 27.2-150400.3.6.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server 12 SP5 | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | emacs | 24.3-25.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | emacs | 25.3-150000.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | emacs | 25.3-150000.3.15.1 |
| SUSE Manager Proxy 4.2 | emacs | 25.3-150000.3.15.1 |
| SUSE Manager Server 4.2 | emacs | 25.3-150000.3.15.1 |
| SUSE OpenStack Cloud 9 | emacs | 24.3-25.12.1 |
| SUSE OpenStack Cloud Crowbar 9 | emacs | 24.3-25.12.1 |
| Ubuntu 16.04 LTS | xemacs21 | no fix |
| Ubuntu 16.04 LTS | xemacs21-packages | no fix |
| Ubuntu 18.04 LTS | xemacs21 | no fix |
| Ubuntu 18.04 LTS | xemacs21-packages | no fix |
| Ubuntu 20.04 LTS | xemacs21 | no fix |
| Ubuntu 20.04 LTS | xemacs21-packages | no fix |
| Ubuntu 22.04 LTS | emacs | 1:27.1+1-3ubuntu5.2 |
| Ubuntu 22.04 LTS | xemacs21 | no fix |
| Ubuntu 22.04 LTS | xemacs21-packages | no fix |
| Ubuntu 24.04 LTS | xemacs21 | no fix |
| Ubuntu 24.04 LTS | xemacs21-packages | no fix |
| Ubuntu 25.10 | xemacs21 | no fix |
| Ubuntu 25.10 | xemacs21-packages | no fix |
| Ubuntu 26.04 LTS | xemacs21 | no fix |
| Ubuntu 26.04 LTS | xemacs21-packages | no fix |
| Ubuntu 26.10 | xemacs21 | no fix |
| Ubuntu 26.10 | xemacs21-packages | no fix |
| Ubuntu Pro 16.04 LTS | emacs24 | 24.5+1-6ubuntu1.1+esm4 |
| Ubuntu Pro 18.04 LTS | emacs25 | 25.2+1-6ubuntu0.1~esm2 |
| Ubuntu Pro 20.04 LTS | emacs | 1:26.3+1-1ubuntu2+esm1 |
| Ubuntu Pro 24.04 LTS | emacs | 1:29.3+1-1ubuntu2+esm1 |
| openSUSE Leap 15.4 | emacs | 27.2-150400.3.6.1 |
| openSUSE Tumbleweed | emacs | 28.2-2.1 |