Bug 1490409 (CVE-2017-14482) - CVE-2017-14482 emacs: command injection flaw within "enriched mode" handling
Summary: CVE-2017-14482 emacs: command injection flaw within "enriched mode" handling
Alias: CVE-2017-14482
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 1490410 1490451 1490452
Blocks: 1490413
TreeView+ depends on / blocked
Reported: 2017-09-11 13:40 UTC by Andrej Nemec
Modified: 2021-02-17 01:35 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file using Emacs, a remote attacker could exploit this flaw to execute arbitrary commands with the privileges of the Emacs user.
Clone Of:
Last Closed: 2017-09-22 08:41:54 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2771 0 normal SHIPPED_LIVE Important: emacs security update 2017-09-19 22:36:15 UTC

Description Andrej Nemec 2017-09-11 13:40:27 UTC
Enriched mode implements an extension command to the text/enriched format called "x-display", which stores "display" text properties. It's possible to use this extension command to transparently execute arbitrary code in an Emacs process that opens a text/enriched file.

Upstream issue:


Upstream patch:




Comment 1 Andrej Nemec 2017-09-11 13:40:58 UTC
Created emacs tracking bugs for this issue:

Affects: fedora-all [bug 1490410]

Comment 5 errata-xmlrpc 2017-09-19 18:36:49 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2771 https://access.redhat.com/errata/RHSA-2017:2771

Comment 6 Stefan Cornelius 2017-09-25 13:16:35 UTC

This issue can be mitigated by adding the following lines to the Emacs init file (for example ~/.emacs, ~/emacs.d/init.el, site-start.el) and avoiding options that would bypass normal initialization, like 'emacs -Q':

  ;; Mitigate CVE-2017-14482 in Emacs 25.2 and earlier
(require 'enriched)
(defun enriched-decode-display-prop (start end &optional param)
  (list start end))

Note You need to log in before you can comment on or make changes to this bug.