CVSS: 9.8EPSS: 1%CPEs: 4EXPL: 0CVE-2022-4170
https://notcve.org/view.php?id=CVE-2022-4170
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. El paquete rxvt-unicode es vulnerable a la ejecución remota de código, en la extensión en segundo plano de Perl, cuando un atacante puede controlar los datos escritos en el terminal del usuario y se configuran ciertas opciones. • https://bugzilla.redhat.com/show_bug.cgi?id=2151597 https://security.gentoo.org/glsa/202310-20 https://www.openwall.com/lists/oss-security/2022/12/05/1 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.5EPSS: 0%CPEs: 5EXPL: 7CVE-2021-42574 – environment: Unicode's bidirectional (BiDi) override characters can cause trojan source attacks
https://notcve.org/view.php?id=CVE-2021-42574
An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). • https://github.com/simplylu/CVE-2021-42574 https://github.com/waseeld/CVE-2021-42574 https://github.com/shiomiyan/CVE-2021-42574 http://www.openwall.com/lists/oss-security/2021/11/01/1 http://www.openwall.com/lists/oss-security/2021/11/01/4 http://www.openwall.com/lists/oss-security/2021/11/01/5 http://www.openwall.com/lists/oss-security/2021/11/01/6 http://www.openwall.com/lists/oss-security/2021/11/02/10 http://www.unicode.org/versions/Unicod • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-838: Inappropriate Encoding for Output Context •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 2CVE-2021-42694
https://notcve.org/view.php?id=CVE-2021-42694
An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard (all versions). • https://github.com/simplylu/CVE-2021-42694 http://www.openwall.com/lists/oss-security/2021/11/01/1 http://www.openwall.com/lists/oss-security/2021/11/01/6 http://www.unicode.org/versions/Unicode14.0.0 https://cwe.mitre.org/data/definitions/1007.html https://security.gentoo.org/glsa/202210-09 https://trojansource.codes https://www.kb.cert.org/vuls/id/999008 https://www.scyon.nl/post/trojans-in-your-source-code https://www.unicode.org/reports/tr36 https& • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-21913
https://notcve.org/view.php?id=CVE-2020-21913
International Components for Unicode (ICU-20850) v66.1 was discovered to contain a use after free bug in the pkg_createWithAssemblyCode function in the file tools/pkgdata/pkgdata.cpp. Se ha detectado que International Components for Unicode (ICU-20850) versión v66.1, contiene un bug de uso de memoria previamente liberada en la función pkg_createWithAssemblyCode en el archivo tools/pkgdata/pkgdata.cpp • https://github.com/unicode-org/icu/pull/886 https://lists.debian.org/debian-lts-announce/2021/10/msg00008.html https://unicode-org.atlassian.net/browse/ICU-20850 https://www.debian.org/security/2021/dsa-5014 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 2CVE-2021-33477
https://notcve.org/view.php?id=CVE-2021-33477
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline. rxvt-unicode versión 9.22, rxvt versión 2.7.10, mrxvt versión 0.5.4 y Eterm versión 0.9.7 permiten una ejecución de código (potencialmente remoto) debido al manejo inapropiado de determinadas secuencias de escape (ESC GQ). Una respuesta es terminada con una nueva línea • http://cvs.schmorp.de/rxvt-unicode/Changes?view=log http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583 https://git.enlightenment.org/apps/eterm.git/log https://lists.debian.org/debian-lts-announce/2021/05/msg00026.html https://lists.debian.org/debian-lts-announce/2021/06/msg00010.html https://lists.debian.org/debian-lts-announce/2021/06/msg00011.html https://lists.debian.org/debian-lts-announce/2021/06/msg00012.html https://lists.fedoraproject.org/archive • CWE-755: Improper Handling of Exceptional Conditions •