The remote NewStart CGSL host, running version MAIN 7.02, has emacs packages installed that are affected by multiple vulnerabilities:

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     etags program. For example, a victim may use the etags -u * command (suggested in the etags     documentation) in a situation where the current working directory has contents that depend on untrusted     input. (CVE-2022-48337)

  - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a     source-code file, because lib-src/etags.c uses the system C library function in its implementation of the     ctags program. For example, a victim may use the ctags * command (suggested in the ctags documentation)     in a situation where the current working directory has contents that depend on untrusted input.
    (CVE-2022-45939)

  - An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function     has a local command injection vulnerability. The ruby-find-library-file function is an interactive     function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-     command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may     cause commands to be executed. (CVE-2022-48338)

  - An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability.
    In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and     parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be     executed. (CVE-2022-48339)

  - emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a     crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is     fixed in 29.0.90 (CVE-2023-27985)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-134 advisory.

    emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a     crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification.
    (CVE-2023-27985)

    emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a     crafted mailto: URI with unescaped double-quote characters. (CVE-2023-27986)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Emacs 28.1 から 28.2 の emacsclient-mail.desktop は、細工された mailto: URI を介したシェルコマンドインジェクションに脆弱です。これは、Desktop Entry Specification のコンプライアンスの欠如に関連しています。これは 29.0.90 で修正されていますCVE-2023-27985

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

したがって、ALAS2023-2023-134 のアドバイザリに記載されている複数の脆弱性の影響を受けます。

  - Emacs 28.1 〜 28.2 の emacsclient-mail.desktop は、細工された mailto: URI によるシェルコマンドの注入に対して脆弱です。これは、Desktop Entry Specification のコンプライアンスの欠如に関連しています。
    (CVE-2023-27985)

  - Emacs 28.1 〜 28.2 の emacsclient-mail.desktop は、エスケープされていない二重符号文字を含む細工された mailto: URI を介した Emacs Lisp コードの注入に対して脆弱です。(CVE-2023-27986)

Nessus はこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

An update of the emacs package has been released.

因此，它受到公告 ALAS2023-2023-134 中提及的多个漏洞影响。

  - Emacs 28.1 至 28.2 版中的 emacsclient-mail.desktop 容易通过构建的 mailto: URI 受到 shell 命令注入。这与不符合桌面输入规范有关。
    (CVE-2023-27985)

  - Emacs 28.1 至 28.2 版中的 emacsclient-mail.desktop 容易通过具有非转义双引号字符的构建 mailto: URI 受到 Emacs Lisp 代码注入。(CVE-2023-27986)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - Emacs 28.1 到 28.2 中的 emacsclient-mail.desktop 容易透過特製的 mailto: URI 受到 shell 命令插入的影響。此弱點與不符合 Desktop Entry Specification 有關。此問題已在 29.0.90 中修正 (CVE-2023-27985)

請注意，Nessus 依賴供應商報告的套件存在。

因此，會受到 ALAS2023-2023-134 公告中所提及的多個弱點影響。

  - Emacs 28.1 至 28.2 版中的 emacsclient-mail.desktop 容易受到透過特製的 mailto: URI 執行的 Shell 命令插入攻擊。此弱點與不符合 Desktop Entry Specification 有關。
    (CVE-2023-27985)

  - Emacs 28.1 至 28.2 版中的 emacsclient-mail.desktop 容易受到 Emacs Lisp 程式碼注入攻擊，攻擊者可透過包含未逸出的雙引號字元的特製 mailto:URI 執行此攻擊。(CVE-2023-27986)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Emacs 28.1 到 28.2 中的 emacsclient-mail.desktop 容易受到通过特制 mailto: URI 所导致的 shell 命令注入的影响。这与不符合桌面输入规范有关。已在 29.0.90 中修复 (CVE-2023-27985)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a     crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is     fixed in 29.0.90 (CVE-2023-27985)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of emacs installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-27985 advisory.

  - emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a     crafted mailto: URI. This is related to lack of compliance with the Desktop Entry Specification. It is     fixed in 29.0.90 (CVE-2023-27985)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
242832	NewStart CGSL MAIN 7.02 : emacs Multiple Vulnerabilities (NS-SA-2025-0115)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	critical
173343	Amazon Linux 2023 : emacs, emacs-common, emacs-devel (ALAS2023-2023-134)	Nessus	Amazon Linux Local Security Checks	2023/3/23	2024/12/11	high
250067	Linux Distros のパッチ未適用の脆弱性: CVE-2023-27985	Nessus	Misc.	2025/8/15	2025/8/15	high
173343	Amazon Linux 2023 : emacs、emacs-common、emacs-devel (ALAS2023-2023-134)	Nessus	Amazon Linux Local Security Checks	2023/3/23	2024/12/11	high
204404	Photon OS 5.0: Emacs PHSA-2023-5.0-0048	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	high
173343	Amazon Linux 2023：emacs、emacs-common、emacs-devel (ALAS2023-2023-134)	Nessus	Amazon Linux Local Security Checks	2023/3/23	2024/12/11	high
250067	Linux Distros 未修補的弱點：CVE-2023-27985	Nessus	Misc.	2025/8/15	2025/8/15	high
173343	Amazon Linux 2023：emacs、emacs-common、emacs-devel (ALAS2023-2023-134)	Nessus	Amazon Linux Local Security Checks	2023/3/23	2024/12/11	high
250067	Linux Distros 未修补的漏洞：CVE-2023-27985	Nessus	Misc.	2025/8/15	2025/8/15	high
250067	Linux Distros Unpatched Vulnerability : CVE-2023-27985	Nessus	Misc.	2025/8/15	2025/8/15	high
173385	CBL Mariner 2.0 Security Update: emacs (CVE-2023-27985)	Nessus	MarinerOS Local Security Checks	2023/3/24	2025/2/10	high

偵測

搜尋 Plugin

critical

high

high

high

high

high

high

high

high

high

high