Read the docs
TI-2015-07611 Aliases CVE-2015-9231GHSA-32xm-x7pr-x3m2

iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS…

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 version 3.0.0 (and unreleased 2.9.x versions such as 2.9.20150717) that resulted in a potential information disclosure. In an attempt to see whether the text under the cursor (or selected text) was a URL, the text would be sent as an unencrypted DNS query. This has the potential to result in passwords and other sensitive information being sent in cleartext without the user being aware.

Why it matters now

EPSS 0.0223 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:iterm2:iterm2:2.9.20151111:*:*:*:*:*:*:*2.9.20151111VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20151229:*:*:*:*:*:*:*2.9.20151229VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160102:*:*:*:*:*:*:*2.9.20160102VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160113:*:*:*:*:*:*:*2.9.20160113VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160206:*:*:*:*:*:*:*2.9.20160206VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160313:*:*:*:*:*:*:*2.9.20160313VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160422:*:*:*:*:*:*:*2.9.20160422VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160426:*:*:*:*:*:*:*2.9.20160426VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160510:*:*:*:*:*:*:*2.9.20160510VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:2.9.20160523:*:*:*:*:*:*:*2.9.20160523VulnerableiTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20151111:*:*:*:*:*:*:* Versions 2.9.20151111 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20151229:*:*:*:*:*:*:* Versions 2.9.20151229 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160102:*:*:*:*:*:*:* Versions 2.9.20160102 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160113:*:*:*:*:*:*:* Versions 2.9.20160113 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160206:*:*:*:*:*:*:* Versions 2.9.20160206 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160313:*:*:*:*:*:*:* Versions 2.9.20160313 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160422:*:*:*:*:*:*:* Versions 2.9.20160422 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160426:*:*:*:*:*:*:* Versions 2.9.20160426 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160510:*:*:*:*:*:*:* Versions 2.9.20160510 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:2.9.20160523:*:*:*:*:*:*:* Versions 2.9.20160523 Vulnerable ·iTerm2
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:iterm2:iterm2:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.0:preview:*:*:*:*:*:*3.0.0 previewVulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.1:preview:*:*:*:*:*:*3.0.1 previewVulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.8:*:*:*:*:*:*:*3.0.8VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.9:*:*:*:*:*:*:*3.0.9VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.10:*:*:*:*:*:*:*3.0.10VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.11:*:*:*:*:*:*:*3.0.11VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.12:*:*:*:*:*:*:*3.0.12VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.13:*:*:*:*:*:*:*3.0.13VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.14:*:*:*:*:*:*:*3.0.14VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.15:*:*:*:*:*:*:*3.0.15VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.0.20160531:*:*:*:*:*:*:*3.0.20160531VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta:*:*:*:*:*:*3.1.0 betaVulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta1:*:*:*:*:*:*3.1.0 beta1VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta10:*:*:*:*:*:*3.1.0 beta10VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta2:*:*:*:*:*:*3.1.0 beta2VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta3:*:*:*:*:*:*3.1.0 beta3VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta4:*:*:*:*:*:*3.1.0 beta4VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta5:*:*:*:*:*:*3.1.0 beta5VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta6:*:*:*:*:*:*3.1.0 beta6VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta7:*:*:*:*:*:*3.1.0 beta7VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta8:*:*:*:*:*:*3.1.0 beta8VulnerableiTerm2
cpe:2.3:a:iterm2:iterm2:3.1.0:beta9:*:*:*:*:*:*3.1.0 beta9VulnerableiTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.0:preview:*:*:*:*:*:* Versions 3.0.0 preview Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.1:preview:*:*:*:*:*:* Versions 3.0.1 preview Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.9:*:*:*:*:*:*:* Versions 3.0.9 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.10:*:*:*:*:*:*:* Versions 3.0.10 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.11:*:*:*:*:*:*:* Versions 3.0.11 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.12:*:*:*:*:*:*:* Versions 3.0.12 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.13:*:*:*:*:*:*:* Versions 3.0.13 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.14:*:*:*:*:*:*:* Versions 3.0.14 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.15:*:*:*:*:*:*:* Versions 3.0.15 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.0.20160531:*:*:*:*:*:*:* Versions 3.0.20160531 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta:*:*:*:*:*:* Versions 3.1.0 beta Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta1:*:*:*:*:*:* Versions 3.1.0 beta1 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta10:*:*:*:*:*:* Versions 3.1.0 beta10 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta2:*:*:*:*:*:* Versions 3.1.0 beta2 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta3:*:*:*:*:*:* Versions 3.1.0 beta3 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta4:*:*:*:*:*:* Versions 3.1.0 beta4 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta5:*:*:*:*:*:* Versions 3.1.0 beta5 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta6:*:*:*:*:*:* Versions 3.1.0 beta6 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta7:*:*:*:*:*:* Versions 3.1.0 beta7 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta8:*:*:*:*:*:* Versions 3.1.0 beta8 Vulnerable ·iTerm2
  • cpe:2.3:a:iterm2:iterm2:3.1.0:beta9:*:*:*:*:*:* Versions 3.1.0 beta9 Vulnerable ·iTerm2

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-9231
  2. 2026-10-03 Alias added: GHSA-32xm-x7pr-x3m2

References

Exploit 1

Advisory 7

  • TI-2024-25648 An issue was discovered in iTerm2 3.5.x before 3.5.2. CVSS 3.1CRITICAL 9.8
  • TI-2023-24916 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of… CVSS 3.1CRITICAL 9.8
  • TI-2023-24915 iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of… CVSS 3.1CRITICAL 9.8
  • TI-2026-29861 In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p… CVSS 3.1HIGH 7.8
  • TI-2024-25647 In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored… CVSS 3.1CRITICAL 9.8
  • TI-2022-22670 iTerm2 before 3.4.18 mishandles a DECRQSS response. CVSS 3.1CRITICAL 9.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences