Bug 1222049 (CVE-2024-30202) - VUL-0: CVE-2024-30202: emacs: arbitrary Lisp code is evaluated as part of turning on Org mode
Summary: VUL-0: CVE-2024-30202: emacs: arbitrary Lisp code is evaluated as part of tur...
Status: NEW
Alias: CVE-2024-30202
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/398852/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-30202:7.8:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-27 10:28 UTC by SMASH SMASH
Modified: 2024-07-19 08:56 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Andrea Mattiazzo 2024-03-27 10:30:07 UTC 
(In reply to SMASH SMASH from comment #0)
> In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on
> Org mode. This affects Org Mode before 9.6.23.
> 
> References:
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-30202
> https://www.cve.org/CVERecord?id=CVE-2024-30202
> https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
> 
> Patch:
> https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-
> 29&id=2bc865ace050ff118db43f01457f95f95112b877
> https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/
> ?id=4255d5dcc0657915f90e4fba7e0a5514cced514d

Misstyped, patch for this CVE are:
- https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=befa9fcaae29a6c9a283ba371c3c5234c7f644eb
- https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=003ddacf1c8d869b1858181c29ea21b731a8d8d9
Comment 2 Dr. Werner Fink 2024-03-27 13:26:48 UTC 
As Factory is fixed ... is this valid for SLE-15 or SLE-12

SLE-15-SP4/emacs-27.2> pkgtouch -p1 ../CVE-2024-30202.patch 
2 out of 2 hunks FAILED -- saving rejects to file lisp/org/org-macro.el.rej
Comment 5 Dr. Werner Fink 2024-03-27 14:34:05 UTC 
(In reply to Andrea Mattiazzo from comment #4)
> (In reply to Andrea Mattiazzo from comment #3)
> > Looking through the code:
> > 
> > Tracking as affected:
> > - SUSE:ALP:Source:Standard:1.0/emacs

SR#324964