CVE-2022-45939

Name
CVE-2022-45939
Description
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://git.savannah.gnu.org/cgit/emacs.git/commit/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:* emacs >= None <= 28.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
emacs 3.17-community 28.2-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
emacs 3.18-community 28.2-r8 Natanael Copa <ncopa@alpinelinux.org> fixed