From: Xi Lu Date: Sat, 11 Mar 2023 10:53:37 +0000 (+0800) Subject: Org Mode vulnerability CVE-2023-28617 is fixed (1/2) X-Git-Tag: archive/raspbian/1%29.2+1-2+rpi1~1^2~39^2~1 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=320ab831aad7b66605e3778abe51a29cc377fb46;p=emacs.git Org Mode vulnerability CVE-2023-28617 is fixed (1/2) https://security-tracker.debian.org/tracker/CVE-2023-28617 This upstream patch (1/2) has been incorporated to fix the problem: * lisp/ob-latex.el: Fix command injection vulnerability (org-babel-execute:latex): Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'. TINYCHANGE Origin: https://git.savannah.gnu.org/cgit/emacs/org-mode.git/commit/?id=a8006ea580ed74f27f974d60b598143b04ad1741 Bug-Debian: https://bugs.debian.org/1033342 --- diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el index 7253803af9e..73139c836b8 100644 --- a/lisp/org/ob-latex.el +++ b/lisp/org/ob-latex.el @@ -205,17 +205,14 @@ This function is called by `org-babel-execute-src-block'." (if (string-suffix-p ".svg" out-file) (progn (shell-command "pwd") - (shell-command (format "mv %s %s" - (concat (file-name-sans-extension tex-file) "-1.svg") - out-file))) + (rename-file (concat (file-name-sans-extension tex-file) "-1.svg") + out-file t)) (error "SVG file produced but HTML file requested"))) ((file-exists-p (concat (file-name-sans-extension tex-file) ".html")) (if (string-suffix-p ".html" out-file) - (shell-command "mv %s %s" - (concat (file-name-sans-extension tex-file) - ".html") - out-file) - (error "HTML file produced but SVG file requested"))))) + (rename-file (concat (file-name-sans-extension tex-file) ".html") + out-file t) + (error "HTML file produced but SVG file requested"))))) ((or (string= "pdf" extension) imagemagick) (with-temp-file tex-file (require 'ox-latex)