emacs-orgmode@gnu.org archives
 help / color / mirror / code / Atom feed
* [ANN] Emergency bugfix release: Org mode 9.7.5
@ 2024-06-22 16:10 Ihor Radchenko
  2024-06-22 17:49 ` Ihor Radchenko
                   ` (4 more replies)
  0 siblings, 5 replies; 21+ messages in thread
From: Ihor Radchenko @ 2024-06-22 16:10 UTC (permalink / raw)
  To: emacs-orgmode; +Cc: Bastien

Dear all,

I just released Org mode 9.7.5 that fixes a critical vulnerability.
The release is coordinated with emergency Emacs 29.4 release.

Please upgrade your Org mode *and* Emacs ASAP.

The vulnerability involves arbitrary Shell code evaluation when
previewing attachments in Emacs MUA (gnus-based: at least, mu4e,
Notmuch, Gnus itself) or when opening third-party Org files. All the
earlier versions of Org mode are affected.

Note that the vulnerability solved in this release has nothing to do
with recent Org 9.6.23 release
(https://list.orgmode.org/871q7zbldp.fsf@localhost/). It existed since
long time ago and was discovered by accident.

-- 
Ihor Radchenko // yantar92,
Org mode contributor,
Learn more about Org mode at <https://orgmode.org/>.
Support Org development at <https://liberapay.com/org-mode>,
or support my work at <https://liberapay.com/yantar92>


^ permalink raw reply	[flat|nested] 21+ messages in thread

end of thread, other threads:[~2024-07-29 18:42 UTC | newest]

Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-22 16:10 [ANN] Emergency bugfix release: Org mode 9.7.5 Ihor Radchenko
2024-06-22 17:49 ` Ihor Radchenko
2024-06-22 23:55   ` Greg Troxel
2024-06-23  1:58     ` Steven Allen
2024-06-22 17:59 ` emacs-orgmode
2024-06-22 19:15   ` Ihor Radchenko
2024-06-24  9:09     ` Assigned: CVE-2024-39331 (was: [ANN] Emergency bugfix release: Org mode 9.7.5) Ihor Radchenko
2024-06-24  8:08 ` [ANN] Emergency bugfix release: Org mode 9.7.5 Bastien Guerry
2024-06-28 15:09 ` [POLL] We plan to remove #+LINK: ...%(my-function) placeholder from link abbreviation spec (was: [ANN] Emergency bugfix release: Org mode 9.7.5) Ihor Radchenko
2024-06-28 15:51   ` [POLL] We plan to remove #+LINK: ...%(my-function) placeholder from link abbreviation spec Suhail Singh
2024-06-28 16:20     ` Steven Allen
2024-06-28 16:45       ` Suhail Singh
2024-06-28 16:55         ` Ihor Radchenko
2024-06-28 17:34           ` Suhail Singh
2024-06-28 17:01         ` Steven Allen
2024-06-28 17:55           ` Suhail Singh
2024-06-28 18:16             ` Steven Allen
2024-06-28 15:23 ` [POLL] Bug of Feature? Attack vector via deceiving link abbrevs (was: [ANN] Emergency bugfix release: Org mode 9.7.5) Ihor Radchenko
2024-06-28 15:52   ` Steven Allen
2024-06-28 15:54   ` [POLL] Bug of Feature? Attack vector via deceiving link abbrevs Suhail Singh
2024-07-29 18:42   ` [POLL] Bug of Feature? Attack vector via deceiving link abbrevs (was: [ANN] Emergency bugfix release: Org mode 9.7.5) Ihor Radchenko

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).