CVE-2024-39331
Publication date 23 June 2024
Last updated 19 September 2024
Ubuntu priority
In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
Status
Package | Ubuntu Release | Status |
---|---|---|
emacs | 24.04 LTS noble |
Fixed 1:29.3+1-1ubuntu2+esm1
|
22.04 LTS jammy |
Fixed 1:27.1+1-3ubuntu5.2
|
|
20.04 LTS focal |
Fixed 1:26.3+1-1ubuntu2+esm1
|
|
emacs24 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
16.04 LTS xenial |
Fixed 24.5+1-6ubuntu1.1+esm4
|
|
emacs25 | 24.04 LTS noble | Not in release |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Fixed 25.2+1-6ubuntu0.1~esm2
|
|
org-mode | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
xemacs21 | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
|
xemacs21-packages | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Needs evaluation
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu ProReferences
Related Ubuntu Security Notices (USN)
- USN-7027-1
- Emacs vulnerabilities
- 19 September 2024
Other references
- https://www.cve.org/CVERecord?id=CVE-2024-39331
- https://www.openwall.com/lists/oss-security/2024/06/23/1
- https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
- https://list.orgmode.org/87sex5gdqc.fsf%40localhost/
- https://lists.gnu.org/archive/html/info-gnu-emacs/2024-06/msg00000.html
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8
- https://www.openwall.com/lists/oss-security/2024/06/23/2
- https://news.ycombinator.com/item?id=40768225