CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-4170
https://notcve.org/view.php?id=CVE-2022-4170
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. El paquete rxvt-unicode es vulnerable a la ejecución remota de código, en la extensión en segundo plano de Perl, cuando un atacante puede controlar los datos escritos en el terminal del usuario y se configuran ciertas opciones. • https://bugzilla.redhat.com/show_bug.cgi?id=2151597 https://security.gentoo.org/glsa/202310-20 https://www.openwall.com/lists/oss-security/2022/12/05/1 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 7.6EPSS: 1%CPEs: 17EXPL: 0CVE-2014-3121
https://notcve.org/view.php?id=CVE-2014-3121
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands. rxvt-unicode anterior a 9.20 no maneja debidamente secuencias de escape OSC, lo que permite a atacantes remotos asistidos por usuario manipular propiedades de ventana X y ejecutar comandos arbitrarios. • http://dist.schmorp.de/rxvt-unicode/Changes http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html http://lists.opensuse.org/opensuse-updates/2014-06/msg00038.html http://seclists.org/oss-sec/2014/q2/204 http://www.debian.org/security/2014/dsa-2925 http://www.securityfocus.com/bid/67155 https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133166.html https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133195.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 3.7EPSS: 0%CPEs: 118EXPL: 0CVE-2008-1142
https://notcve.org/view.php?id=CVE-2008-1142
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine. Rxvt versión 2.6.4 abre una ventana terminal en :0 si no se establece la variable de entorno DISPLAY, lo que podría permitir a los usuarios locales secuestrar conexiones X11. NOTA: más tarde se informó que rxvt-unicode, mrxvt, aterm, multi-aterm y wterm también se ven afectados. • http://article.gmane.org/gmane.comp.security.oss.general/122 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296 http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html http://secunia.com/advisories/29576 http://secunia.com/advisories/30224 http://secunia.com/advisories/30225 http://secunia.com/advisories/30226 http://secunia.com/advisories/30227 http://secunia.com/advisories/30229 http://secunia.com/advisories/31687 http://security.gentoo.org/glsa/glsa • CWE-264: Permissions, Privileges, and Access Controls •