CVE-2021-33477: debian debian_linux
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2021-33477MGASA-2021-0358UBUNTU-CVE-2021-33477DEBIAN-CVE-2021-33477DLA-2671-1DLA-2681-1DLA-2682-1openSUSE-SU-2024:12386-1
Published 20-05-2021Last modified 03-08-2024
Vulnerability summary
CVE-2021-33477 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 4.09% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
8.8/10
010
High · v3.1 (NVD)EPSS score
4.09%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 20-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
CVSS metrics
5 scores · 4 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · AlpineEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Medium 6.5Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
4.09%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.09% on 20-09-2026
20-09-202620-10-2026
EPSS score4.09%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (openwall.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian4 products
- eterm< 0.9.6-6.1 | < 0.9.6-5+deb9u1
- mrxvt< 0.5.4-2+deb9u1
- rxvt-unicode< 9.22-11 | < 9.22-1+deb9u1
- debian_linuxEOL9.0
Ubuntu4 products
- etermAll versions (No fix recorded)
- mrxvtAll versions (No fix recorded)
- rxvtAll versions (No fix recorded)
- rxvt-unicodeAll versions (No fix recorded)
Mageia3 products
- eterm< 0.9.7-3.1.mga8
- mrxvt< 0.5.4-15.1.mga8
- rxvt-unicode< 9.26-1.mga8
Alpine2 products
- mrxvt< 0.5.4-r8
- rxvt-unicode< 9.22-r7 | < 9.22-r8
Eterm_project1 product
- eterm0.9.7
Fedoraproject1 product
- fedoraEOL33 | 34
Mrxvt_project1 product
- mrxvt0.5.4
Opensuse1 product
- rxvt-unicode&distro=openSUSE Tumbleweed< 9.30-2.1
Rxvt_project1 product
- rxvt2.7.10
Rxvt-unicode_project1 product
- rxvt-unicode9.22
10 vendors · 19 products
References
32 links- www.openwall.com/lists/oss-security/2021/05/17/1X Refsource MISCWEBREPORTExploitMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2017/05/01/20X Refsource MISCREPORTMailing ListThird Party Advisory
- cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583X Refsource MISCREPORTPatchThird Party Advisory
- packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.htmlX Refsource MISCREPORTExploitThird Party AdvisoryVDB Entry
- sourceforge.net/projects/materm/files/mrxvt%20source/X Refsource MISCREPORTProductThird Party Advisory
lists.debian.org/debian-lts-announce/2021/05/msg00026.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 32 references
- lists.debian.org/debian-lts-announce/2021/06/msg00010.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/06/msg00012.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/06/msg00011.htmlMailing ListX Refsource MLISTThird Party Advisory