CVE-2017-14482
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 4.0%
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
Produtos afetados
n/a · n/aReferências
https://access.redhat.com/errata/RHSA-2017:2771https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70https://security.gentoo.org/glsa/201801-07https://www.debian.org/security/2017/dsa-3970https://www.gnu.org/software/emacs/index.html#Releaseshttp://www.debian.org/security/2017/dsa-3975http://www.openwall.com/lists/oss-security/2017/09/11/1