Advisory ROSA-SA-2023-2191

Software: emacs 24.3-23.
OS: rosa-server79

package_evr_string: 24.3-23.res7.1

CVE-ID: CVE-2022-48339
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and srcdir parameter come from external input, and the parameters are not escaped. If the file name or directory name contains shell metacharacters, the code can be executed.
CVE-STATUS: Fixed
CVE-REV: Run the yum update emacs command to close it