Security update for emacs SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4305-1 Final 1 1 2022-12-01T08:12:40Z current 2022-12-01T08:12:40Z 2022-12-01T08:12:40Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for emacs This update for emacs fixes the following issues: - CVE-2022-45939: Fixed shell command injection via source code files when using ctags (bsc#1205822). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-4305,SUSE-OpenStack-Cloud-9-2022-4305,SUSE-OpenStack-Cloud-Crowbar-9-2022-4305,SUSE-SLE-SAP-12-SP4-2022-4305,SUSE-SLE-SERVER-12-SP2-BCL-2022-4305,SUSE-SLE-SERVER-12-SP3-BCL-2022-4305,SUSE-SLE-SERVER-12-SP4-LTSS-2022-4305,SUSE-SLE-SERVER-12-SP5-2022-4305 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224305-1/ Link for SUSE-SU-2022:4305-1 https://lists.suse.com/pipermail/sle-security-updates/2022-December/013182.html E-Mail link for SUSE-SU-2022:4305-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1205822 SUSE Bug 1205822 https://www.suse.com/security/cve/CVE-2022-45939/ SUSE CVE CVE-2022-45939 page SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP3-BCL SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 emacs-24.3-25.9.1 emacs-el-24.3-25.9.1 emacs-info-24.3-25.9.1 emacs-nox-24.3-25.9.1 emacs-x11-24.3-25.9.1 etags-24.3-25.9.1 emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP2-BCL emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP3-BCL emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP4-LTSS emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server 12 SP5 emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 emacs-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 emacs-el-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 emacs-info-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 emacs-nox-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 emacs-x11-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 etags-24.3-25.9.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 emacs-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 emacs-el-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 emacs-info-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 emacs-nox-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 emacs-x11-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 etags-24.3-25.9.1 as a component of SUSE OpenStack Cloud 9 emacs-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 emacs-el-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 emacs-info-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 emacs-nox-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 emacs-x11-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 etags-24.3-25.9.1 as a component of SUSE OpenStack Cloud Crowbar 9 GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input. CVE-2022-45939 SUSE Linux Enterprise Server 12 SP2-BCL:emacs-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP2-BCL:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP2-BCL:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP2-BCL:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP2-BCL:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP2-BCL:etags-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:emacs-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP3-BCL:etags-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:emacs-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP4-LTSS:etags-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:emacs-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server 12 SP5:etags-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:emacs-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP4:etags-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:emacs-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:emacs-el-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:emacs-info-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:emacs-nox-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:emacs-x11-24.3-25.9.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:etags-24.3-25.9.1 SUSE OpenStack Cloud 9:emacs-24.3-25.9.1 SUSE OpenStack Cloud 9:emacs-el-24.3-25.9.1 SUSE OpenStack Cloud 9:emacs-info-24.3-25.9.1 SUSE OpenStack Cloud 9:emacs-nox-24.3-25.9.1 SUSE OpenStack Cloud 9:emacs-x11-24.3-25.9.1 SUSE OpenStack Cloud 9:etags-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:emacs-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:emacs-el-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:emacs-info-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:emacs-nox-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:emacs-x11-24.3-25.9.1 SUSE OpenStack Cloud Crowbar 9:etags-24.3-25.9.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224305-1/ https://www.suse.com/security/cve/CVE-2022-45939.html CVE-2022-45939 https://bugzilla.suse.com/1205822 SUSE Bug 1205822 https://bugzilla.suse.com/1208026 SUSE Bug 1208026 https://bugzilla.suse.com/1208348 SUSE Bug 1208348