CVE-2017-14482 Code injection in n/a
Remote attackers can execute arbitrary code by sending crafted emails with malicious enriched text content to GNU Emacs users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-14482?
CVE-2017-14482 is a high-severity code injection vulnerability in Debian Debian Linux, published on 14 Sep 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).
Which versions are affected by CVE-2017-14482?
It affects 2 products.
Linux distribution packages (40)
emacs Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-common Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-debuginfo Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-el Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-filesystem Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-nox Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs-terminal Red Hat:enterprise_linux:7::client | All versions | 1:24.3-20.el7_4 |
emacs Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-common Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-el Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-filesystem Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-nox Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs-terminal Red Hat:enterprise_linux:7::computenode | All versions | 1:24.3-20.el7_4 |
emacs Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-common Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-debuginfo Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-el Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-filesystem Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-nox Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs-terminal Red Hat:enterprise_linux:7::server | All versions | 1:24.3-20.el7_4 |
emacs Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-common Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-el Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-filesystem Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-nox Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs-terminal Red Hat:enterprise_linux:7::workstation | All versions | 1:24.3-20.el7_4 |
emacs SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Point of Sale 11 SP3 | All versions | 22.3-42.3.1 |
emacs SUSE:Linux Enterprise Server 11 SP3-LTSS | All versions | 22.3-42.3.1 |
emacs SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 22.3-42.3.1 |
emacs SUSE:Linux Enterprise Server 11 SP4 | All versions | 22.3-42.3.1 |
emacs SUSE:Linux Enterprise Server 12 SP1-LTSS | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Server 12 SP2 | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Server 12 SP3 | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Server 12-LTSS | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 24.3-25.3.1 |
emacs SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 22.3-42.3.1 |
Products include Debian Debian Linux, Gnu Emacs.
How do I fix CVE-2017-14482?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-14482 being exploited?
There is no known exploitation of CVE-2017-14482 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DLA-1101-1, DSA-3970-1, DSA-3975-1, GHSA-2v7h-5r83-vh8r, MGASA-2017-0476, RHSA-2017:2771 and 4 more.