CVE-2024-30204 - OpenCVE

In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/03/25/2
http://www.openwall.com/lists/oss-security/2024/04/08/3
http://www.openwall.com/lists/oss-security/2024/04/08/4
http://www.openwall.com/lists/oss-security/2024/04/08/6
http://www.openwall.com/lists/oss-security/2024/04/08/7
http://www.openwall.com/lists/oss-security/2024/04/10/3
http://www.openwall.com/lists/oss-security/2024/04/10/4
http://www.openwall.com/lists/oss-security/2024/04/10/5
http://www.openwall.com/lists/oss-security/2024/04/10/6
http://www.openwall.com/lists/oss-security/2024/04/11/4
https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c
https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29
https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html
https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html
https://nvd.nist.gov/vuln/detail/CVE-2024-30204
https://www.cve.org/CVERecord?id=CVE-2024-30204
https://www.openwall.com/lists/oss-security/2024/03/25/2

History

Mon, 04 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-276
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}`	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}` cvssV3_1 `{'score': 2.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-25T00:00:00

Updated: 2024-11-04T16:34:51.409Z

Reserved: 2024-03-25T00:00:00

Link: CVE-2024-30204

Vulnrichment

Updated: 2024-08-02T01:25:03.423Z

NVD

Status : Awaiting Analysis

Published: 2024-03-25T15:15:52.523

Modified: 2024-11-04T17:35:14.370

Link: CVE-2024-30204

Redhat

Severity : Moderate

Publid Date: 2024-03-25T00:00:00Z

Links: CVE-2024-30204 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-30204", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-11-04T16:34:51.409Z", "dateReserved": "2024-03-25T00:00:00", "datePublished": "2024-03-25T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-01T18:12:31.908377"}, "descriptions": [{"lang": "en", "value": "In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"}, {"url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c"}, {"name": "[debian-lts-announce] 20240429 [SECURITY] [DLA 3801-1] emacs security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html"}, {"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3802-1] org-mode security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html"}, {"name": "[oss-security] 20240325 Re: GNU emacs 29.3 released to fix security issues", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/03/25/2"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/4"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/3"}, {"name": "[oss-security] 20240411 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/11/4"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/4"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/6"}, {"name": "[oss-security] 20240410 Re: Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/5"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/7"}, {"name": "[oss-security] 20240408 Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/3"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/6"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-276", "lang": "en", "description": "CWE-276 Incorrect Default Permissions"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-18T13:42:11.496611Z", "id": "CVE-2024-30204", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-04T16:34:51.409Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:25:03.423Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29", "tags": ["x_transferred"]}, {"url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c", "tags": ["x_transferred"]}, {"name": "[debian-lts-announce] 20240429 [SECURITY] [DLA 3801-1] emacs security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html"}, {"name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3802-1] org-mode security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html"}, {"name": "[oss-security] 20240325 Re: GNU emacs 29.3 released to fix security issues", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/03/25/2"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/4"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/3"}, {"name": "[oss-security] 20240411 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/11/4"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/4"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/6"}, {"name": "[oss-security] 20240410 Re: Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/5"}, {"name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/7"}, {"name": "[oss-security] 20240408 Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/08/3"}, {"name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2024/04/10/6"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29", "tags": ["x_transferred"]}, {"url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c", "tags": ["x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html", "name": "[debian-lts-announce] 20240429 [SECURITY] [DLA 3801-1] emacs security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html", "name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3802-1] org-mode security update", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/25/2", "name": "[oss-security] 20240325 Re: GNU emacs 29.3 released to fix security issues", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/4", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/3", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/11/4", "name": "[oss-security] 20240411 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/4", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/6", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/5", "name": "[oss-security] 20240410 Re: Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/7", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/3", "name": "[oss-security] 20240408 Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/6", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:25:03.423Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.8, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-30204", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-18T13:42:11.496611Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "CWE-276 Incorrect Default Permissions"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-18T13:42:31.848Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"}, {"url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html", "name": "[debian-lts-announce] 20240429 [SECURITY] [DLA 3801-1] emacs security update", "tags": ["mailing-list"]}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html", "name": "[debian-lts-announce] 20240430 [SECURITY] [DLA 3802-1] org-mode security update", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/25/2", "name": "[oss-security] 20240325 Re: GNU emacs 29.3 released to fix security issues", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/4", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/3", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/11/4", "name": "[oss-security] 20240411 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/4", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/6", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/5", "name": "[oss-security] 20240410 Re: Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/7", "name": "[oss-security] 20240408 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/08/3", "name": "[oss-security] 20240408 Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/04/10/6", "name": "[oss-security] 20240410 Re: Is CVE-2024-30203 bogus? (Emacs)", "tags": ["mailing-list"]}], "descriptions": [{"lang": "en", "value": "In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-05-01T18:12:31.908377"}}}, "cveMetadata": {"cveId": "CVE-2024-30204", "state": "PUBLISHED", "dateUpdated": "2024-11-04T16:34:51.409Z", "dateReserved": "2024-03-25T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-03-25T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments."}, {"lang": "es", "value": "En Emacs anterior a 29.3, la vista previa de LaTeX est\u00e1 habilitada de forma predeterminada para los archivos adjuntos de correo electr\u00f3nico."}], "id": "CVE-2024-30204", "lastModified": "2024-11-04T17:35:14.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 2.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-25T15:15:52.523", "references": [{"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/03/25/2"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/08/3"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/08/4"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/08/6"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/08/7"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/10/3"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/10/4"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/10/5"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/10/6"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2024/04/11/4"}, {"source": "cve@mitre.org", "url": "https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-29&id=6f9ea396f49cbe38c2173e0a72ba6af3e03b271c"}, {"source": "cve@mitre.org", "url": "https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-29"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00023.html"}, {"source": "cve@mitre.org", "url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00024.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}