vulnwire
8.8high

CVE-2017-14482

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containin…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.0%
percentile 91%
Public exploits
0
none known

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Exploit prediction (EPSS)

4.01% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.08.8CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

References

  • debian.org /security/2017/dsa-3975 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • git.savannah.gnu.org /cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70 · x_refsource_CONFIRM, x_transferred
  • debian.org /security/2017/dsa-3970 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • security.gentoo.org /glsa/201801-07 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • access.redhat.com /errata/RHSA-2017:2771 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • gnu.org /software/emacs/index.html#Releases · x_refsource_CONFIRM, x_transferred
  • openwall.com /lists/oss-security/2017/09/11/1 · x_refsource_CONFIRM, x_transferred
  • debbugs.gnu.org /cgi/bugreport.cgi?bug=28350 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.