diff --git a/SOURCES/emacs-etags-local-command-injection-vulnerability.patch b/SOURCES/emacs-etags-local-command-injection-vulnerability.patch
new file mode 100644
index 0000000..418b7d7
--- /dev/null
+++ b/SOURCES/emacs-etags-local-command-injection-vulnerability.patch
@@ -0,0 +1,105 @@
+From 01a4035c869b91c153af9a9132c87adb7669ea1c Mon Sep 17 00:00:00 2001
+From: lu4nx <lx@shellcodes.org>
+Date: Tue, 6 Dec 2022 15:42:40 +0800
+Subject: [PATCH] Fix etags local command injection vulnerability
+
+* lib-src/etags.c: (escape_shell_arg_string): New function.
+(process_file_name): Use it to quote file names passed to the
+shell. (Bug#59817)
+---
+ lib-src/etags.c | 63 +++++++++++++++++++++++++++++++++++++++++++++----
+ 1 file changed, 58 insertions(+), 5 deletions(-)
+
+diff --git a/lib-src/etags.c b/lib-src/etags.c
+index d1d20858cdd..ba0092cc637 100644
+--- a/lib-src/etags.c
++++ b/lib-src/etags.c
+@@ -399,6 +399,7 @@ static void put_entries (node *);
+ static void clean_matched_file_tag (char const * const, char const * const);
+
+ static void do_move_file (const char *, const char *);
++static char *escape_shell_arg_string (char *);
+ static char *concat (const char *, const char *, const char *);
+ static char *skip_spaces (char *);
+ static char *skip_non_spaces (char *);
+@@ -1670,13 +1671,16 @@ process_file_name (char *file, language *lang)
+ else
+ {
+ #if MSDOS || defined (DOS_NT)
+- char *cmd1 = concat (compr->command, " \"", real_name);
+- char *cmd = concat (cmd1, "\" > ", tmp_name);
++ int buf_len = strlen (compr->command) + strlen (" \"\" > \"\"") + strlen (real_name) + strlen (tmp_name) + 1;
++ char *cmd = xmalloc (buf_len);
++ snprintf (cmd, buf_len, "%s \"%s\" > \"%s\"", compr->command, real_name, tmp_name);
+ #else
+- char *cmd1 = concat (compr->command, " '", real_name);
+- char *cmd = concat (cmd1, "' > ", tmp_name);
++ char *new_real_name = escape_shell_arg_string (real_name);
++ char *new_tmp_name = escape_shell_arg_string (tmp_name);
++ int buf_len = strlen (compr->command) + strlen (" > ") + strlen (new_real_name) + strlen (new_tmp_name) + 1;
++ char *cmd = xmalloc (buf_len);
++ snprintf (cmd, buf_len, "%s %s > %s", compr->command, new_real_name, new_tmp_name);
+ #endif
+- free (cmd1);
+ int tmp_errno;
+ if (system (cmd) == -1)
+ {
+@@ -7124,6 +7128,55 @@ etags_mktmp (void)
+ return templt;
+ }
+
++/*
++ * Adds single quotes around a string, if found single quotes, escaped it.
++ * Return a newly-allocated string.
++ *
++ * For example:
++ * escape_shell_arg_string("test.txt") => 'test.txt'
++ * escape_shell_arg_string("'test.txt") => ''\''test.txt'
++ */
++static char *
++escape_shell_arg_string (char *str)
++{
++ char *p = str;
++ int need_space = 2; /* ' at begin and end */
++
++ while (*p != '\0')
++ {
++ if (*p == '\'')
++ need_space += 4; /* ' to '\'', length is 4 */
++ else
++ need_space++;
++
++ p++;
++ }
++
++ char *new_str = xnew (need_space + 1, char);
++ new_str[0] = '\'';
++ new_str[need_space-1] = '\'';
++
++ int i = 1; /* skip first byte */
++ p = str;
++ while (*p != '\0')
++ {
++ new_str[i] = *p;
++ if (*p == '\'')
++ {
++ new_str[i+1] = '\\';
++ new_str[i+2] = '\'';
++ new_str[i+3] = '\'';
++ i += 3;
++ }
++
++ i++;
++ p++;
++ }
++
++ new_str[need_space] = '\0';
++ return new_str;
++}
++
+ static void
+ do_move_file(const char *src_file, const char *dst_file)
+ {
+--
+2.36.1
+
diff --git a/SOURCES/emacs-htmlfontify-command-injection-vulnerability.patch b/SOURCES/emacs-htmlfontify-command-injection-vulnerability.patch
new file mode 100644
index 0000000..73122c8
--- /dev/null
+++ b/SOURCES/emacs-htmlfontify-command-injection-vulnerability.patch
@@ -0,0 +1,26 @@
+From 1b4dc4691c1f87fc970fbe568b43869a15ad0d4c Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Sat, 24 Dec 2022 16:28:54 +0800
+Subject: [PATCH] Fix htmlfontify.el command injection vulnerability.
+
+* lisp/htmlfontify.el (hfy-text-p): Fix command injection
+vulnerability. (Bug#60295)
+---
+ lisp/htmlfontify.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lisp/htmlfontify.el b/lisp/htmlfontify.el
+index df4c6ab079c..389b92939cc 100644
+--- a/lisp/htmlfontify.el
++++ b/lisp/htmlfontify.el
+@@ -1912,7 +1912,7 @@ hfy-make-directory
+
+ (defun hfy-text-p (srcdir file)
+ "Is SRCDIR/FILE text? Uses `hfy-istext-command' to determine this."
+- (let* ((cmd (format hfy-istext-command (expand-file-name file srcdir)))
++ (let* ((cmd (format hfy-istext-command (shell-quote-argument (expand-file-name file srcdir))))
+ (rsp (shell-command-to-string cmd)))
+ (string-match "text" rsp)))
+
+--
+2.36.1
diff --git a/SOURCES/emacs-ob-latex-command-injection-vulnerability.patch b/SOURCES/emacs-ob-latex-command-injection-vulnerability.patch
new file mode 100644
index 0000000..275ada9
--- /dev/null
+++ b/SOURCES/emacs-ob-latex-command-injection-vulnerability.patch
@@ -0,0 +1,43 @@
+From a8006ea580ed74f27f974d60b598143b04ad1741 Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Sat, 11 Mar 2023 18:53:37 +0800
+Subject: * lisp/org/ob-latex.el: Fix command injection vulnerability
+
+(org-babel-execute:latex):
+Replaced the `(shell-command "mv BAR NEWBAR")' with `rename-file'.
+
+TINYCHANGE
+---
+ lisp/org/ob-latex.el | 13 +++++--------
+ 1 file changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/lisp/org/ob-latex.el b/lisp/org/ob-latex.el
+index a2c24b3..ce39628 100644
+--- a/lisp/org/ob-latex.el
++++ b/lisp/org/ob-latex.el
+@@ -218,17 +218,14 @@ This function is called by `org-babel-execute-src-block'."
+ (if (string-suffix-p ".svg" out-file)
+ (progn
+ (shell-command "pwd")
+- (shell-command (format "mv %s %s"
+- (concat (file-name-sans-extension tex-file) "-1.svg")
+- out-file)))
++ (rename-file (concat (file-name-sans-extension tex-file) "-1.svg")
++ out-file t))
+ (error "SVG file produced but HTML file requested")))
+ ((file-exists-p (concat (file-name-sans-extension tex-file) ".html"))
+ (if (string-suffix-p ".html" out-file)
+- (shell-command "mv %s %s"
+- (concat (file-name-sans-extension tex-file)
+- ".html")
+- out-file)
+- (error "HTML file produced but SVG file requested")))))
++ (rename-file (concat (file-name-sans-extension tex-file) ".html")
++ out-file t)
++ (error "HTML file produced but SVG file requested")))))
+ ((or (string= "pdf" extension) imagemagick)
+ (with-temp-file tex-file
+ (require 'ox-latex)
+--
+cgit v1.1
+
diff --git a/SOURCES/emacs-ruby-mode-local-command-injection-vulnerability.patch b/SOURCES/emacs-ruby-mode-local-command-injection-vulnerability.patch
new file mode 100644
index 0000000..38c219d
--- /dev/null
+++ b/SOURCES/emacs-ruby-mode-local-command-injection-vulnerability.patch
@@ -0,0 +1,28 @@
+From 9a3b08061feea14d6f37685ca1ab8801758bfd1c Mon Sep 17 00:00:00 2001
+From: Xi Lu <lx@shellcodes.org>
+Date: Fri, 23 Dec 2022 12:52:48 +0800
+Subject: [PATCH] Fix ruby-mode.el local command injection vulnerability
+ (bug#60268)
+
+* lisp/progmodes/ruby-mode.el
+(ruby-find-library-file): Fix local command injection vulnerability.
+---
+ lisp/progmodes/ruby-mode.el | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lisp/progmodes/ruby-mode.el b/lisp/progmodes/ruby-mode.el
+index 1f3e9b6ae7b..a4aa61905e4 100644
+--- a/lisp/progmodes/ruby-mode.el
++++ b/lisp/progmodes/ruby-mode.el
+@@ -1820,7 +1820,7 @@ ruby-find-library-file
+ (setq feature-name (read-string "Feature name: " init))))
+ (let ((out
+ (substring
+- (shell-command-to-string (concat "gem which " feature-name))
++ (shell-command-to-string (concat "gem which " (shell-quote-argument feature-name)))
+ 0 -1)))
+ (if (string-match-p "\\`ERROR" out)
+ (user-error "%s" out)
+--
+2.36.1
+
diff --git a/SPECS/emacs.spec b/SPECS/emacs.spec
index 1bcc215..440a584 100644
--- a/SPECS/emacs.spec
+++ b/SPECS/emacs.spec
@@ -5,7 +5,7 @@ Summary: GNU Emacs text editor
Name: emacs
Epoch: 1
Version: 27.2
-Release: 8%{?dist}
+Release: 8%{?dist}.1
License: GPLv3+ and CC0-1.0
URL: http://www.gnu.org/software/emacs/
Source0: https://ftp.gnu.org/gnu/emacs/emacs-%{version}.tar.xz
@@ -29,6 +29,10 @@ Patch2: emacs-system-crypto-policies.patch
Patch3: emacs-glibc-2.34.patch
Patch4: emacs-ctags-local-command-execute-vulnerability.patch
Patch5: emacs-64KB-page-size-for-pdump.patch
+Patch6: emacs-etags-local-command-injection-vulnerability.patch
+Patch7: emacs-htmlfontify-command-injection-vulnerability.patch
+Patch8: emacs-ruby-mode-local-command-injection-vulnerability.patch
+Patch9: emacs-ob-latex-command-injection-vulnerability.patch
BuildRequires: gcc
BuildRequires: atk-devel
BuildRequires: cairo-devel
@@ -193,6 +197,10 @@ Development header files for Emacs.
%patch3 -p1 -b .glibc2.34
%patch4 -p1 -b .ctags-local-command-execute-vulnerability
%patch5 -p1 -b .64KB-page-size-for-pdump
+%patch6 -p1 -b .etags-local-command-injection-vulnerability
+%patch7 -p1 -b .htmlfontify-command-injection-vulnerability
+%patch8 -p1 -b .ruby-mode-local-command-injection-vulnerability
+%patch9 -p1 -b .ob-latex-command-injection-vulnerability
autoconf
# We prefer our emacs.desktop file
@@ -483,6 +491,12 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
%{_includedir}/emacs-module.h
%changelog
+* Tue Apr 4 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8.1
+- Fix etags local command injection vulnerability (#2184369)
+- Fix htmlfontify.el command injection vulnerability (#2184368)
+- Fix ruby-mode.el local command injection vulnerability (#2184367)
+- Fix ob-latex.el command injection vulnerability (#2184377)
+
* Tue Jan 10 2023 Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8
- Use a 64KB page size for pdump (#1979804)
@@ -505,7 +519,7 @@ rm %{buildroot}%{_datadir}/icons/hicolor/scalable/mimetypes/emacs-document23.svg
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 1:27.2-2
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-* Thu Mar 27 2021 Bhavin Gandhi <bhavin7392@gmail.com> - 1:27.2-1
+* Sat Mar 27 2021 Bhavin Gandhi <bhavin7392@gmail.com> - 1:27.2-1
- emacs-27.2 is available
* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 1:27.1-3