| Package | emacs25 |
|---|---|
| Version | 25.1+1-4+deb9u6 (stretch) |
| Related CVEs | CVE-2024-53920 CVE-2025-1244 |
Multiple problems were discovered in GNU Emacs, the extensible, customisable, self-documenting real-time display editor.
CVE-2024-53920
Several ways to trigger arbitrary code execution were discovered in Emacs’s support for editing files in its own dialect of Lisp. These include arbitrary code execution upon opening an otherwise innocent-looking file, with any (or no) file extension, for editing.
CVE-2025-1244
Improper handling of custom ‘man’ URI schemes could allow an attacker to execute arbitrary shell commands by tricking users into visiting a specially crafted website, or an HTTP URL with a redirect.
For Debian 9 stretch, these problems have been fixed in version 25.1+1-4+deb9u6.
We recommend that you upgrade your emacs25 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.