{"schemaVersion":3,"id":"OPENSUSE-SU-2022:10222-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for rxvt-unicode\n\nThis update for rxvt-unicode fixes the following issues:\n\nUpdate to 9.26\n\n- ev_iouring.c was wrongly required during compilation, and wrongly\n  not packaged.\n\nUpdate to 9.25 (boo#1186174 CVE-2021-33477)\n\n- for the 17.5th anniversary, and because many distributions seem to\n  remove rxvt in favour of urxvt, this release resurrects rclock as\n  urclock.\n- add support for systemd socket-based activation - debian bug #917105,\n  freebsd bug #234276.\n- do not destruct perl on exit anymore: this might fail for a variety of\n  reasons, and takes unneccessary time.\n- remove any macros from urxvtperl manpage(s), should fix debian\n  bug 858385.\n- the old bg image resources are now provided by the background\n  extension, and perl is thus required for bg image support. No\n  configuration change is needed: urxvt autoloads the background\n  ext if any bg image resource/option is present (for OSC sequences to\n  work you need to enable it explicity). The old bg image\n  resources are also now deprecated; users are encouraged to\n  switch to the new bg image interface (see man urxvt-background).\n- confirm-paste now checks for any ctlchars, not just newlines.\n- searchable scrollback will now ignore bracketed paste mode sequences\n  (prompted by Daniel Gröber's patch).\n- drop ISO 2022 locale support. ISO 2022 encodings are not supported in\n  POSIX locales and clash with vt100 charset emulation (the luit\n  program can be used as a substitute).\n- perl didn't parse rgba colours specified as an array correctly,\n  only allowing 0 and 100% intensity for each component (this affected\n  fill and tint).\n- when iterating over resources, urxvt will now try to properly handle\n  multipart resources (such as '*background.expr'), for the benefit\n  of autoloading perl extensions.\n- ESC G (query rxvt graphics mode) has been disabled due to security\n  implications. The rxvt graphics mode was removed in rxvt-unicode 1.5,\n  and no programs relying on being able to query the mode are known.\n- work around API change breakage in perl 5.28, based on a patch by\n  Roman Bogorodskiy.\n- improved security: rob nation's (obsolete) graphics mode queries\n  no longer reply with linefeed in secure/default mode.\n- ISO 8613-3 direct colour SGR sequences (patch by Fengguang Wu).\n- xterm focus reporting mode (patch by Daniel Hahler).\n- xterm SGR mouse mode.\n- implement DECRQM. Patch by Přemysl Eric Janouch.\n- add missing color index parameter to OSC 4 response. Patch\n  by Přemysl Eric Janouch.\n- in some window managers, if smart resize was enabled, urxvt\n  erroneously moved the window on font change - awesome bug\n  #532, arch linux bug ##34807 (patch by Uli Schlachter).\n- fix urxvtd crash when using a background expression.\n- properly restore colors when using fading and reverse video\n  is enabled while urxvt is focused and then disabled while it\n  is not focused, or vice versa (patch by Daniel Hahler).\n- fix high memory usage when an extension repeatedly hides and\n  shows an overlay (reported by Marcel Lautenbach).\n- expose priv_modes member and constants to perl extensions\n  (patch by Rastislav Barlik).\n- fix a whole slew of const sillyness, unfortunately forced upon\n  us by ISO C++.\n- update to libecb 0x00010006.\n- disable all thread support in ecb.h as we presumably don't need it.\n- slightly improve Makefile source dependencies.\n- work around bugs in newer Pod::Xhtml versions (flags incorrect formatting codes\n  in xhtml/html sections but does not interpret correct ones).\n- New file: /usr/bin/urclock\n- restore the -256color binaries","dates":{"published":"2022-11-30T08:19:21.000Z","modified":"2026-02-04T03:10:58.499Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"opensuse","product":"rxvt-unicode&distro=openSUSE Leap 15.3","name":"rxvt-unicode","label":"rxvt-unicode&distro=openSUSE Leap 15.3","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rxvt-unicode&distro=openSUSE Leap 15.3","purlType":"rpm","versions":[{"text":"< 9.26-bp154.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.26-bp154.2.3.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"rxvt-unicode&distro=openSUSE Leap 15.4","name":"rxvt-unicode","label":"rxvt-unicode&distro=openSUSE Leap 15.4","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/rxvt-unicode&distro=openSUSE Leap 15.4","purlType":"rpm","versions":[{"text":"< 9.26-bp154.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.26-bp154.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rxvt-unicode&distro=SUSE Package Hub 15 SP3","name":"rxvt-unicode","label":"rxvt-unicode&distro=SUSE Package Hub 15 SP3","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rxvt-unicode&distro=SUSE Package Hub 15 SP3","purlType":"rpm","versions":[{"text":"< 9.26-bp154.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.26-bp154.2.3.1","eol":null,"hubHref":null},{"vendor":"suse","product":"rxvt-unicode&distro=SUSE Package Hub 15 SP4","name":"rxvt-unicode","label":"rxvt-unicode&distro=SUSE Package Hub 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/rxvt-unicode&distro=SUSE Package Hub 15 SP4","purlType":"rpm","versions":[{"text":"< 9.26-bp154.2.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.26-bp154.2.3.1","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YIRRHCE53YNBLDGNULGNED3XGUMUZDMO/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1186174","label":"bugzilla.suse.com/1186174","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1142","label":"www.suse.com/security/cve/CVE-2008-1142","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33477","label":"www.suse.com/security/cve/CVE-2021-33477","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2008-1142","CVE-2021-33477"],"downstream":[],"duplicates":[],"related":["CVE-2008-1142","CVE-2021-33477"]},"timeline":[{"kind":"published","date":"2022-11-30T08:19:21.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:10:58.499Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T18:12:19.795Z","stale":false,"partial":false}}