CVE-2024-30205

nvd nist

Published: Mar 25, 2024Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In Emacs before 29.3, Org mode considers contents of remote files to be trusted. This affects Org Mode before 9.6.23.

Affected (3)

Products: Gnu: Emacs, Org Mode · Debian: Debian Linux

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Emacs	Before 29.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Gnu Org Mode	Before 9.6.23

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Related CWEs

CWE-494

Download of Code Without Integrity Check

The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

References (12)

http://www.openwall.com/lists/oss-security/2024/03/25/2

Source: cve@mitre.org

Mailing List

https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=2bc865ace050ff118db43f01457f95f95112b877

Source: cve@mitre.org

Patch

https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29

Source: cve@mitre.org

Release Notes

https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=4255d5dcc0657915f90e4fba7e0a5514cced514d

Source: cve@mitre.org

Patch

https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html

Source: cve@mitre.org

Mailing List

https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html

Source: cve@mitre.org

Mailing List

http://www.openwall.com/lists/oss-security/2024/03/25/2