CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50495 – Ubuntu Security Notice USN-6684-1
https://notcve.org/view.php?id=CVE-2023-50495
12 Dec 2023 — NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry(). Se descubrió que NCurse v6.4-20230418 contenía un error de segmentación a través del componente _nc_wrap_entry(). It was discovered that ncurses incorrectly handled certain function return values, possibly leading to segmentation fault. A local attacker could possibly use this to cause a denial of service. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40359
https://notcve.org/view.php?id=CVE-2023-40359
14 Aug 2023 — xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature. xterm antes de 380 soporta los informes de ReGIS para nombres de conjuntos de caracteres incluso si tienen caracteres inesperados (es decir, ni alfanuméricos ni guión bajo), también conocido como un problema de p... • https://invisible-island.net/xterm/xterm.log.html#xterm_380 •
CVSS: 10.0EPSS: 5%CPEs: 4EXPL: 1CVE-2022-45063 – Gentoo Linux Security Advisory 202211-09
https://notcve.org/view.php?id=CVE-2022-45063
10 Nov 2022 — xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions. xterm anterior a 375 permite la ejecución de código mediante operaciones de fuentes, por ejemplo, porque una respuesta OSC 50 puede tener Ctrl-g y, por lo tanto, conducir a la ejecución de comandos dentro del modo de edición de línea ... • http://www.openwall.com/lists/oss-security/2022/11/10/1 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 3CVE-2022-24130 – Gentoo Linux Security Advisory 202208-22
https://notcve.org/view.php?id=CVE-2022-24130
31 Jan 2022 — xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. xterm versiones hasta el Parche 370, cuando el soporte Sixel está habilitado, permite a atacantes desencadenar un desbordamiento de búfer en el archivo set_sixel en graphics_sixel.c por medio de texto diseñado Multiple vulnerabilities have been discovered in xterm, the worst of which could result in denial of service. Versions less than 371 are affected. • https://invisible-island.net/xterm/xterm.log.html • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-27135 – xterm: crash when processing combining characters
https://notcve.org/view.php?id=CVE-2021-27135
10 Feb 2021 — xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence. xterm antes del parche #366 permite a los atacantes remotos ejecutar código arbitrario o provocar una denegación de servicio (fallo de segmentación) a través de una secuencia de caracteres de combinación UTF-8 manipulada A flaw was found in xterm. A specially crafted sequence of combining characters causes an out of bounds write leading... • http://seclists.org/fulldisclosure/2021/May/52 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 6%CPEs: 3EXPL: 1CVE-2006-7236 – xterm - DECRQSS Remote Command Execution
https://notcve.org/view.php?id=CVE-2006-7236
02 Jan 2009 — The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences. La configuración por defecto de sid en xterm para Debian GNU/Linux y posiblemente Ubuntu activa el recurso allowWindowOps, lo que permite a atacantes asistidos por el usuario, ejecutar código de su elección o tener otro impacto no determinado a través de secuencias de escape. • https://www.exploit-db.com/exploits/32690 • CWE-16: Configuration •
CVSS: 9.8EPSS: 9%CPEs: 1EXPL: 0CVE-2008-2383 – xterm: arbitrary command injection
https://notcve.org/view.php?id=CVE-2008-2383
02 Jan 2009 — CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071. Vulnerabilidad de inyección CRLF en xterm, permite a atacantes asistidos por usuarios ejecutar comandos de su elección a través de caracteres LF (también conocido como \n) que rodean el nombre del comando dentro de una ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 30%CPEs: 3EXPL: 1CVE-2005-3120 – Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC)
https://notcve.org/view.php?id=CVE-2005-3120
17 Oct 2005 — Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters. • https://www.exploit-db.com/exploits/1256 • CWE-131: Incorrect Calculation of Buffer Size •