debian/org-mode vulnerabilities

Latest debian/org-mode CVEs

Newest publication first

1. DLA-3848-1 org-mode - security update

   Published 2024-06-29

   Unknown

2. DSA-5718-1 org-mode - security update

   Published 2024-06-25

   Unknown

3. CVE-2024-39331 In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

   Published 2024-06-23

   Critical·CVSS 9.8 EPSS 1.3%

   In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %(...) link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5.

4. DLA-3802-1 org-mode - security update

   Published 2024-04-30

   Unknown

5. CVE-2024-30204 In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

   Published 2024-03-25

   Low·CVSS 2.8 EPSS 0.48%

   In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

6. CVE-2024-30202 In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

   Published 2024-03-25

   High·CVSS 7.8 EPSS 1.1%

   In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode. This affects Org Mode before 9.6.23.

7. CVE-2024-30203 In Emacs before 29.3, Gnus treats inline MIME contents as trusted.

   Published 2024-03-25

   Medium·CVSS 5.5 EPSS 0.58%

   In Emacs before 29.3, Gnus treats inline MIME contents as trusted.

8. CVE-2024-30205 In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.

   Published 2024-03-25

   High·CVSS 7.1 EPSS 0.48%

   In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.

9. DLA-3616-1 org-mode - security update

   Published 2023-10-12

   Unknown

10. CVE-2023-28617 org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

    Published 2023-03-19

    High·CVSS 7.8 EPSS 0.47%

    org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.