The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0598-1 advisory.

    - CVE-2022-48337: Fixed etags local command injection vulnerability (bsc#1208515).
      - CVE-2022-48339: Fixed htmlfontify.el command injection vulnerability (bsc#1208512).
      - CVE-2022-48338: Fixed ruby-mode.el local command injection vulnerability (bsc#1208514).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-122 advisory.

    GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

    An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

    An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the 'etags -u *' command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the emacs package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the 'etags -u *' command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7027-1 advisory.

    It was discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2022-45939)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu     20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-48337)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-48338)

    Xi Lu discovered that Emacs incorrectly handled input sanitization. An attacker could possibly use this     issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2022-48339)

    It was discovered that Emacs incorrectly handled filename sanitization. An attacker could possibly use     this issue to execute arbitrary commands. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and     Ubuntu 22.04 LTS. (CVE-2023-28617)

    It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use     this issue to crash the program, resulting in a denial of service. This issue only affected Ubuntu 16.04     LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-30203, CVE-2024-30204,     CVE-2024-30205)

    It was discovered that Emacs incorrectly handled certain crafted files. An attacker could possibly use     this issue to execute arbitrary commands. (CVE-2024-39331)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a75929bd-b6a4-11ed-bad6-080027f5fec9 advisory.

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of emacs installed on the remote host is prior to 27.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-1981 advisory.

    GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

    An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

    An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     ctags program. For example, a victim may use the 'ctags *' command (suggested in the ctags documentation)     in a situation where the current working directory has contents that depend on untrusted input.
    (CVE-2022-45939)

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the 'etags -u *' command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the 'etags -u *' command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

  - org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute     arbitrary commands via a file name or directory name that contains shell metacharacters. (CVE-2023-28617)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-6067:07 advisory.

    * emacs: Regression of CVE-2023-28617 fixes in the MIRACLE LINUX (CVE-2023-2491)
      * emacs: command execution via shell metacharacters (CVE-2022-48337)
      * emacs: local command injection in ruby-mode.el (CVE-2022-48338)
      * emacs: command injection vulnerability in htmlfontify.el (CVE-2022-48339)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
172063	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : emacs (SUSE-SU-2023:0598-1)	Nessus	SuSE Local Security Checks	2023/3/3	2026/6/26	critical
173111	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-122)	Nessus	Amazon Linux Local Security Checks	2023/3/21	2025/9/9	critical
176835	EulerOS Virtualization 2.11.1 : emacs (EulerOS-SA-2023-2068)	Nessus	Huawei Local Security Checks	2023/6/7	2023/6/7	critical
177973	EulerOS 2.0 SP11 : emacs (EulerOS-SA-2023-2288)	Nessus	Huawei Local Security Checks	2023/7/4	2023/7/4	critical
207478	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Emacs vulnerabilities (USN-7027-1)	Nessus	Ubuntu Local Security Checks	2024/9/19	2025/9/3	critical
171931	FreeBSD : emacs -- multiple vulnerabilities (a75929bd-b6a4-11ed-bad6-080027f5fec9)	Nessus	FreeBSD Local Security Checks	2023/2/27	2023/10/24	critical
172158	Amazon Linux 2 : emacs (ALAS-2023-1981)	Nessus	Amazon Linux Local Security Checks	2023/3/7	2024/12/11	critical
176818	EulerOS Virtualization 2.11.0 : emacs (EulerOS-SA-2023-2120)	Nessus	Huawei Local Security Checks	2023/6/7	2023/6/7	critical
179019	EulerOS Virtualization 2.10.0 : emacs (EulerOS-SA-2023-2486)	Nessus	Huawei Local Security Checks	2023/7/28	2023/7/28	critical
292019	MiracleLinux 9 : emacs-27.2-8.el9.1 (AXSA:2023-6067:07)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical