CVE-2024-39331

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

References

Affected packages

Debian:11

emacs

Package

Name: emacs
Purl: pkg:deb/debian/emacs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:27.1+1-3.1+deb11u5

Affected versions

1:27.*

1:27.1+1-3.1

1:27.1+1-3.1+deb11u1

1:27.1+1-3.1+deb11u2

1:27.1+1-3.1+deb11u3

1:27.1+1-3.1+deb11u4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

org-mode

Package

Name: org-mode
Purl: pkg:deb/debian/org-mode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.4.0+dfsg-1+deb11u3

Affected versions

9.*

9.4.0+dfsg-1

9.4.0+dfsg-1+deb11u1

9.4.0+dfsg-1+deb11u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

Debian:12

emacs

Package

Name: emacs
Purl: pkg:deb/debian/emacs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:28.2+1-15+deb12u3

Affected versions

1:28.*

1:28.2+1-15

1:28.2+1-15+deb12u1

1:28.2+1-15+deb12u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

org-mode

Package

Name: org-mode
Purl: pkg:deb/debian/org-mode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.5.2+dfsh-5

9.6.6+dfsg-1~exp1

9.6.7+dfsg-1

9.6.8+dfsg-1

9.6.9+dfsg-1

9.6.10+dfsg-1

9.6.21+dfsg-1

9.6.23+dfsg-1

9.6.28+dfsg-1

9.7.5+dfsg-1

9.7.6+dfsg-1

9.7.6+dfsg-2

9.7.11+dfsg-1

9.7.13+dfsg-1

9.7.15+dfsg-1

9.7.16+dfsg-1

9.7.19+dfsg-1

9.7.25+dfsg-1

9.7.27+dfsg-1

9.7.29+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

Debian:13

emacs

Package

Name: emacs
Purl: pkg:deb/debian/emacs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:29.4+1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

org-mode

Package

Name: org-mode
Purl: pkg:deb/debian/org-mode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.7.5+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

Debian:14

emacs

Package

Name: emacs
Purl: pkg:deb/debian/emacs?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:29.4+1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"

org-mode

Package

Name: org-mode
Purl: pkg:deb/debian/org-mode?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.7.5+dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-39331.json"