FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

emacs -- arbitary shell command execution vulnerability of ctags

Affected packages
	emacs	<	28.2_2,3
	emacs-canna	<	28.2_2,3
	emacs-nox	<	28.2_2,3
	emacs-devel	<	30.0.50.202211128,2
	emacs-devel-nox	<	30.0.50.202211128,2

Details

VuXML ID	76e2fcce-92d2-11ed-a635-080027f5fec9
Discovery	2022-11-28
Entry	2023-01-12

lu4nx reports:

GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the ctags program. For example, a victim may use the "ctags *" command (suggested in the ctags documentation) in a situation where the current working directory has contents that depend on untrusted input.

[source]

References

CVE Name	CVE-2022-45939
URL	https://nvd.nist.gov/vuln/detail/CVE-2022-45939