CVE-2024-39331

NameCVE-2024-39331
DescriptionIn Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3848-1, DLA-3849-1, DSA-5718-1, DSA-5719-1
Debian Bugs1074136, 1074137

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
emacs (PTS)bullseye (security), bullseye1:27.1+1-3.1+deb11u5fixed
bookworm, bookworm (security)1:28.2+1-15+deb12u3fixed
sid, trixie1:29.4+1-3fixed
org-mode (PTS)bullseye (security), bullseye9.4.0+dfsg-1+deb11u3fixed
bookworm9.5.2+dfsh-5vulnerable
sid, trixie9.7.11+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
emacssourcebuster1:26.1+1-3.2+deb10u6DLA-3849-1
emacssourcebullseye1:27.1+1-3.1+deb11u5DSA-5719-1
emacssourcebookworm1:28.2+1-15+deb12u3DSA-5719-1
emacssource(unstable)1:29.4+1-11074137
org-modesourcebuster9.1.14+dfsg-3+deb10u3DLA-3848-1
org-modesourcebullseye9.4.0+dfsg-1+deb11u3DSA-5718-1
org-modesource(unstable)9.7.5+dfsg-11074136

Notes

[bookworm] - org-mode <ignored> (Produces only a dependency binary package)
https://www.openwall.com/lists/oss-security/2024/06/23/1
Fixed by: https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29.4&id=c645e1d8205f0f0663ec4a2d27575b238c646c7c (emacs-29.4)
Fixed by: https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8 (release_9.7.5)

Search for package or bug name: Reporting problems