Vulnerabilities

TI-2023-21187 CVE-2023-40359 · GHSA-cwvr-vg72-6p6j

xterm before 380 supports ReGIS reporting for character-set names even if they have…

MEDIUM 50

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00855 Published 2023-08-14 Will not fix

TI-2022-22154 CVE-2022-45063 · GHSA-3cch-wj7f-8g8x

xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may…

MEDIUM 58

xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0656 Published 2022-11-10 Partial fix CWE-77

TI-2022-08075 CVE-2022-24130 · GHSA-5v7p-cf4c-24jq

xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a…

LOW 28

xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.0168 Published 2022-01-31 Fixed CWE-120

TI-2021-08683 CVE-2021-27135 · GHSA-3w4p-5chr-2r8f

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a…

MEDIUM 53

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.07863 Published 2021-02-10 Partial fix

TI-2006-06976 CVE-2006-7236 · GHSA-9r87-p9p6-pqp9

The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables…

MEDIUM 50

The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via esca…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0747 Published 2009-01-02 No fix listed CWE-16

TI-2008-02286 CVE-2008-2383 · GHSA-94vw-2f3v-j88m

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary…

MEDIUM 48

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequ…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04934 Published 2009-01-02 Fixed CWE-94