CVE-2023-2491

2023-05-1700:00:00

ubuntu.com

emacs

red hat

arbitrary command execution

org-mode

ob-latex.el

security regression

enterprise linux

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

30.2%

JSON

A flaw was found in the Emacs text editor. Processing a specially crafted
org-mode code with the “org-babel-execute:latex” function in ob-latex.el
can result in arbitrary command execution. This CVE exists because of a
CVE-2023-28617 security regression for the emacs package in Red Hat
Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.