Invisible Island Xterm vulnerabilities
6 vulnerabilities
Known vulnerabilities in Invisible Island Xterm, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2023-40359invisible-island · xterm +9 moreinvisible-island xtermxterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.CVSS9.8CriticalEPSS0.85%PrioritiseCVE-2022-45063fedoraproject · fedora +37 morefedoraproject fedoraxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.CVSS9.8CriticalEPSS5.45%RoutineCVE-2022-24130debian · debian_linux +18 moredebian debian_linuxxterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.CVSS5.5MediumEPSS1.68%PrioritiseCVE-2021-27135debian · debian_linux +44 moredebian debian_linuxxterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.CVSS9.8CriticalEPSS7.84%PrioritiseCVE-2006-7236invisible-island · xterm +1 moreinvisible-island xtermThe default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.CVSS9.3CriticalEPSS7.47%RoutineCVE-2008-2383invisible-island · xterm +4 moreinvisible-island xtermCRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.CVSS9.3CriticalEPSS4.93%