CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40359
https://notcve.org/view.php?id=CVE-2023-40359
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature. xterm antes de 380 soporta los informes de ReGIS para nombres de conjuntos de caracteres incluso si tienen caracteres inesperados (es decir, ni alfanuméricos ni guión bajo), también conocido como un problema de puntero/desbordamiento. Esto sólo puede ocurrir en instalaciones de xterm configuradas en tiempo de compilación para utilizar una determinada característica experimental. • https://invisible-island.net/xterm/xterm.log.html#xterm_380 •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 1CVE-2022-45063
https://notcve.org/view.php?id=CVE-2022-45063
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions. xterm anterior a 375 permite la ejecución de código mediante operaciones de fuentes, por ejemplo, porque una respuesta OSC 50 puede tener Ctrl-g y, por lo tanto, conducir a la ejecución de comandos dentro del modo de edición de línea vi de Zsh. NOTA: las operaciones de fuentes no están permitidas en las configuraciones predeterminadas de xterm de algunas distribuciones de Linux. • http://www.openwall.com/lists/oss-security/2022/11/10/1 http://www.openwall.com/lists/oss-security/2022/11/10/5 http://www.openwall.com/lists/oss-security/2024/06/15/1 http://www.openwall.com/lists/oss-security/2024/06/17/1 https://invisible-island.net/xterm/xterm.log.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 3CVE-2022-24130
https://notcve.org/view.php?id=CVE-2022-24130
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. xterm versiones hasta el Parche 370, cuando el soporte Sixel está habilitado, permite a atacantes desencadenar un desbordamiento de búfer en el archivo set_sixel en graphics_sixel.c por medio de texto diseñado • https://invisible-island.net/xterm/xterm.log.html https://lists.debian.org/debian-lts-announce/2022/02/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP5Y4O7WBNLV24D22E6LE7RQFYOUVD2U https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4CWYYEBT6AJRJBBQU2KLUOQDHRM7WAV https://security.gentoo.org/glsa/202208-22 https://twitter.com/nickblack/status/1487731459398025216 https://www.openwall.com/lists/oss-security/2022/01/30/ • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 4%CPEs: 3EXPL: 0CVE-2021-27135 – xterm: crash when processing combining characters
https://notcve.org/view.php?id=CVE-2021-27135
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence. xterm antes del parche #366 permite a los atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (fallo de segmentación) a través de una secuencia de caracteres de combinación UTF-8 manipulada A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading to arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. • http://seclists.org/fulldisclosure/2021/May/52 http://www.openwall.com/lists/oss-security/2021/02/10/7 https://access.redhat.com/security/cve/CVE-2021-27135 https://bugzilla.redhat.com/show_bug.cgi?id=1927559 https://bugzilla.suse.com/show_bug.cgi?id=1182091 https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c https://invisible-island.net/xterm/xterm.log.html https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html https://lists.fed • CWE-787: Out-of-bounds Write •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2007-2797 – (mesg: error: tty device is not owned by group `tty')
https://notcve.org/view.php?id=CVE-2007-2797
xterm, including 192-7.el4 in Red Hat Enterprise Linux and 208-3.1 in Debian GNU/Linux, sets the wrong group ownership of tty devices, which allows local users to write data to other users' terminals. xterm, incluido en 192-7.el4 en Red Hat Enterprise Linux y 208-3.1 en Debian GNU/Linux, fija la propiedad incorrecta al grupo de los dispositivos tty, lo cual permite a usuarios locales escribir datos en los terminales de otros usuarios. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=349924 http://secunia.com/advisories/26562 http://secunia.com/advisories/27617 http://secunia.com/advisories/27921 http://securityreason.com/securityalert/3066 http://support.avaya.com/elmodocs2/security/ASA-2007-490.htm http://www.redhat.com/support/errata/RHSA-2007-0701.html http://www.securityfocus.com/archive/1/477469/100/0/threaded http://www.securityfocus.com/archive/1/477632/100/100/threaded http://www.securityfocus.com& •