CVE-2017-14482

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML…

published September 14, 2017

CVSS
—
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04009 · 90.5th percentile
Published
2017-09-14T16:00Z
EPSS history
Timeline
  • 14 SEP 16:00Z
    GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML…
    cvelistv5