Security update for emacs SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4304-1 Final 1 1 2022-12-01T08:12:07Z current 2022-12-01T08:12:07Z 2022-12-01T08:12:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for emacs This update for emacs fixes the following issues: - CVE-2022-45939: Fixed shell command injection via source code files when using ctags (bsc#1205822). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-4304,SUSE-SLE-Module-Basesystem-15-SP4-2022-4304,SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-4304,openSUSE-SLE-15.4-2022-4304 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224304-1/ Link for SUSE-SU-2022:4304-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MU2KN46JJ6TL6CR5QN3O4AZXDYE35Z7A/ E-Mail link for SUSE-SU-2022:4304-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1205822 SUSE Bug 1205822 https://www.suse.com/security/cve/CVE-2022-45939/ SUSE CVE CVE-2022-45939 page SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Desktop Applications 15 SP4 openSUSE Leap 15.4 emacs-27.2-150400.3.3.1 emacs-el-27.2-150400.3.3.1 emacs-info-27.2-150400.3.3.1 emacs-nox-27.2-150400.3.3.1 emacs-x11-27.2-150400.3.3.1 etags-27.2-150400.3.3.1 emacs-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 emacs-el-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 emacs-info-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 emacs-nox-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 etags-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 emacs-x11-27.2-150400.3.3.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP4 emacs-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 emacs-el-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 emacs-info-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 emacs-nox-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 emacs-x11-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 etags-27.2-150400.3.3.1 as a component of openSUSE Leap 15.4 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. CVE-2022-45939 SUSE Linux Enterprise Module for Basesystem 15 SP4:emacs-27.2-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:emacs-el-27.2-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:emacs-info-27.2-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:emacs-nox-27.2-150400.3.3.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:etags-27.2-150400.3.3.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP4:emacs-x11-27.2-150400.3.3.1 openSUSE Leap 15.4:emacs-27.2-150400.3.3.1 openSUSE Leap 15.4:emacs-el-27.2-150400.3.3.1 openSUSE Leap 15.4:emacs-info-27.2-150400.3.3.1 openSUSE Leap 15.4:emacs-nox-27.2-150400.3.3.1 openSUSE Leap 15.4:emacs-x11-27.2-150400.3.3.1 openSUSE Leap 15.4:etags-27.2-150400.3.3.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224304-1/ https://www.suse.com/security/cve/CVE-2022-45939.html CVE-2022-45939 https://bugzilla.suse.com/1205822 SUSE Bug 1205822 https://bugzilla.suse.com/1208026 SUSE Bug 1208026 https://bugzilla.suse.com/1208348 SUSE Bug 1208348