CVE catalog

CVE-2022-48337

Emacs vulnerabilities

Severity: High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published: Feb 20, 2023, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.62% · Oct 25, 2026

A flaw was found in the Emacs package. This flaw allows attackers to execute commands via shell metacharacters in the name of a source-code file. emacs: command execution via shell metacharacters This vulnerability is only triggered when a local user introduces untrusted input, via a file with a crafted name. For this reason, this flaw has been rated with a Moderate security impact. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	emacs	sid	`1:30.2+1-11`	fixed
Debian	emacs	forky	`1:30.2+1-11`	fixed
Debian	emacs	trixie	`1:30.1+1-6+deb13u1`	fixed
Debian	emacs	trixie-security	`1:30.1+1-6+deb13u1`	fixed
Debian	emacs	bookworm	`1:28.2+1-15+deb12u4`	fixed
Debian	emacs	bookworm-security	`1:28.2+1-15+deb12u4`	fixed
Ubuntu	emacs	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-bin-common	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-common	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-el	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-gtk	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-lucid	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-nox	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Ubuntu	emacs-pgtk	noble	`1:29.3+1-1ubuntu2+esm1`	fixed
Suse	emacs	openstack cloud 9	`24.3-25.12.1`	fixed
Suse	emacs	openstack cloud crowbar 9	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server for sap applications 12 sp4	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server 12 sp2-bcl	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server 12 sp4-espos	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server 12 sp4-ltss	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server 12 sp5	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise server for sap applications 12 sp5	`24.3-25.12.1`	fixed
Suse	emacs	linux enterprise high performance computing 15 sp1-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise high performance computing 15 sp2-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise high performance computing 15 sp3-espos	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise high performance computing 15 sp3-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise real time 15 sp3	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server 15 sp1-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server 15 sp2-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server 15 sp3-ltss	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server for sap applications 15 sp1	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server for sap applications 15 sp2	`25.3-150000.3.15.1`	fixed
Suse	emacs	linux enterprise server for sap applications 15 sp3	`25.3-150000.3.15.1`	fixed
Suse	emacs	manager proxy 4.2	`25.3-150000.3.15.1`	fixed
Suse	emacs	manager server 4.2	`25.3-150000.3.15.1`	fixed
Suse	emacs	enterprise storage 7	`25.3-150000.3.15.1`	fixed
Suse	emacs	enterprise storage 7.1	`25.3-150000.3.15.1`	fixed
Opensuse	emacs	tumbleweed	`28.2-2.1`	fixed
Suse	emacs	linux enterprise module for basesystem 15 sp4	`27.2-150400.3.6.1`	fixed
Suse	emacs	linux enterprise module for desktop applications 15 sp4	`27.2-150400.3.6.1`	fixed
Opensuse	emacs	leap 15.4	`27.2-150400.3.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	emacs	source	sid	`1:28.2+1-11`	not yet assigned	Not reported	[1031730]
Debian	emacs	source	forky	`1:28.2+1-11`	not yet assigned	Not reported	[1031730]
Debian	emacs	source	trixie	`1:28.2+1-11`	not yet assigned	Not reported	[1031730]
Debian	emacs	source	bookworm	`1:28.2+1-11`	not yet assigned	Not reported	[1031730]
Ubuntu	emacs	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-bin-common	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-common	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-el	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-gtk	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-lucid	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-nox	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Ubuntu	emacs-pgtk	deb	noble	`1:29.3+1-1ubuntu2+esm1`	Not reported	Not reported	Not reported
Suse	emacs	rpm	openstack cloud 9	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	openstack cloud crowbar 9	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server for sap applications 12 sp4	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server 12 sp2-bcl	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server 12 sp4-espos	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server 12 sp4-ltss	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server 12 sp5	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise server for sap applications 12 sp5	`24.3-25.12.1`	Not reported	SUSE-SU-2023:0597-1	Not reported
Suse	emacs	rpm	linux enterprise high performance computing 15 sp1-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise high performance computing 15 sp2-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise high performance computing 15 sp3-espos	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise high performance computing 15 sp3-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise real time 15 sp3	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server 15 sp1-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server 15 sp2-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server 15 sp3-ltss	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server for sap applications 15 sp1	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server for sap applications 15 sp2	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	linux enterprise server for sap applications 15 sp3	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	manager proxy 4.2	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	manager server 4.2	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	enterprise storage 7	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Suse	emacs	rpm	enterprise storage 7.1	`25.3-150000.3.15.1`	Not reported	SUSE-SU-2023:0675-1	Not reported
Opensuse	emacs	rpm	tumbleweed	`28.2-2.1`	Not reported	OPENSUSE-SU-2024:12721-1	Not reported
Suse	emacs	rpm	linux enterprise module for basesystem 15 sp4	`27.2-150400.3.6.1`	Not reported	SUSE-SU-2023:0598-1	Not reported
Suse	emacs	rpm	linux enterprise module for desktop applications 15 sp4	`27.2-150400.3.6.1`	Not reported	SUSE-SU-2023:0598-1	Not reported
Opensuse	emacs	rpm	leap 15.4	`27.2-150400.3.6.1`	Not reported	SUSE-SU-2023:0598-1	Not reported

[Debian bug #1031730]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[emacs]Unknown
Details (6)
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-bin-common]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-common]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-el]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · all · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-gtk]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-lucid]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-nox]Unknown
Source package: [emacs]
Details (6)
- 1:28.2+1-15+deb12u4 · amd64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · amd64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:28.2+1-15+deb12u4 · arm64 · bookworm-security
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
[emacs-pgtk]Unknown
Source package: [emacs]
Details (2)
- 1:30.1+1-6~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm
- 1:30.1+1-6~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 1:28.2+1-11
  usn · emacs · debian · bookworm

[openSUSE Tumbleweed]

[emacs]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 28.2-2.1
  usn · emacs · opensuse · tumbleweed
[emacs-el]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[emacs-eln]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[emacs-games]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[emacs-info]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · noarch · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[emacs-nox]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[emacs-x11]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed
[etags]Unknown
Source package: [emacs]
Details (1)
- 31.1-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 28.2-2.1
  Version impact unknown
  usn · emacs · opensuse · tumbleweed

Observed: Oct 23, 2026, 6:31:32 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]