CVE-2017-14482

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

GNU Emacs before 25.3 allows remote attackers to execute arbitrary code via email with crafted "Content-Type: text/enriched" data containing an x-display XML element that specifies execution of shell commands, related to an unsafe text/enriched extension in lisp/textmodes/enriched.el, and unsafe Gnus support for enriched and richtext inline MIME objects in lisp/gnus/mm-view.el. In particular, an Emacs user can be instantly compromised by reading a crafted email message (or Usenet news article).

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2017/dsa-3975
http://www.openwall.com/lists/oss-security/2017/09/11/1Mailing List, Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2771
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350Issue Tracking, Mailing List, Patch, Vendor Advisory
https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201801-07
https://www.debian.org/security/2017/dsa-3970Third Party Advisory
https://www.gnu.org/software/emacs/index.html#ReleasesRelease Notes, Vendor Advisory
http://www.debian.org/security/2017/dsa-3975
http://www.openwall.com/lists/oss-security/2017/09/11/1Mailing List, Patch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2771
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350Issue Tracking, Mailing List, Patch, Vendor Advisory
https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25&id=9ad0fcc54442a9a01d41be19880250783426db70Issue Tracking, Patch, Third Party Advisory
https://security.gentoo.org/glsa/201801-07
https://www.debian.org/security/2017/dsa-3970Third Party Advisory
https://www.gnu.org/software/emacs/index.html#ReleasesRelease Notes, Vendor Advisory

Timeline

Published: Sep 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-144835.5flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which CVE-2017-144847.3The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great Internet Mersenne Prime Search (GIMPS) allows local users to gain privile CVE-2017-144867.5The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and CVE-2017-144879.1The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses fro CVE-2017-144895.5The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of s CVE-2017-14495.4IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a CVE-2017-144919.8Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via CVE-2017-144929.8Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via CVE-2017-144939.8Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code vi CVE-2017-144945.9dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handli CVE-2017-144957.5Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a CVE-2017-144967.5Integer underflow in the add_pseudoheader function in dnsmasq before 2.78 , when the --add-mac, --add-cpe-id or --add-subnet option is speci