| Package | emacs24 |
|---|---|
| Version | 24.4+1-5+deb8u6 (jessie), 24.5+1-11+deb9u6 (stretch) |
| Related CVEs | CVE-2022-45939 CVE-2024-53920 CVE-2025-1244 |
Multiple problems were discovered in GNU Emacs, the extensible, customisable, self-documenting real-time display editor.
CVE-2022-45939
Improper use of the system C library function in Emacs’s implementation of
the ctags program could permit shell metacharcater injection when used on
untrusted input source code.
CVE-2024-53920
Several ways to trigger arbitrary code execution were discovered in Emacs’s support for editing files in its own dialect of Lisp. These include arbitrary code execution upon opening an otherwise innocent-looking file, with any (or no) file extension, for editing.
CVE-2025-1244
Improper handling of custom ‘man’ URI schemes could allow an attacker to execute arbitrary shell commands by tricking users into visiting a specially crafted website, or an HTTP URL with a redirect.
For Debian 8 jessie, these problems have been fixed in version 24.4+1-5+deb8u6.
For Debian 9 stretch, these problems have been fixed in version 24.5+1-11+deb9u6.
We recommend that you upgrade your emacs24 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.