CVE-2022-4170: fedoraproject extra_packages_for_enterprise_linux Injection
CVSS: 9.8v3.1CriticalModified
AliasesMGASA-2022-0459openSUSE-SU-2023:0306-1UBUNTU-CVE-2022-4170DEBIAN-CVE-2022-4170openSUSE-SU-2024:13323-1
Published 09-12-2022Last modified 14-04-2025
Vulnerability summary
CVE-2022-4170 is a critical (CVSS 9.8) Injection vulnerability in fedoraproject extra_packages_for_enterprise_linux. EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 82.4% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
2.22%
0%100%
Low · +0.08 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 09-12-2022PublishedVulnerability first disclosed.
- 14-04-2025Last modifiedVulnerability information updated.
Description
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
CVSS metrics
4 scores · 4 sources · 1 versionCritical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.22%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
+0.08 pp
From 2.14% on 20-09-2026
20-09-202620-10-2026
EPSS score2.22%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse3 products
- rxvt-unicode&distro=openSUSE Leap 15.4< 9.31-bp155.3.3.1
- rxvt-unicode&distro=openSUSE Leap 15.5< 9.31-bp155.3.3.1
- rxvt-unicode&distro=openSUSE Tumbleweed< 9.31-1.1
Fedoraproject2 products
Suse2 products
- rxvt-unicode&distro=SUSE Package Hub 15 SP4< 9.31-bp155.3.3.1
- rxvt-unicode&distro=SUSE Package Hub 15 SP5< 9.31-bp155.3.3.1
Debian1 product
- rxvt-unicodeAll versions (No fix recorded) | < 9.31-1
Mageia1 product
- rxvt-unicode< 9.26-1.1.mga8
Rxvt-unicode_project1 product
- rxvt-unicode9.25 | 9.26
Ubuntu1 product
- rxvt-unicodeAll versions (No fix recorded)
7 vendors · 11 products
References
12 links- lists.opensuse.org/archives/…Advisory
