// For flags

CVE-2008-2383

xterm: arbitrary command injection

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka
) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

Vulnerabilidad de inyección CRLF en xterm, permite a atacantes asistidos por usuarios ejecutar comandos de su elección a través de caracteres LF (también conocido como
) que rodean el nombre del comando dentro de una secuencia de escape evice Control Request Status String (DECRQSS) en un fichero de texto, es una cuestión relacionada con CVE-2003-0063 y CVE-2003-0071.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-05-21 CVE Reserved
  • 2009-01-02 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-18 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (30)
URL Tag Source
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
http://secunia.com/advisories/33388 Third Party Advisory
http://secunia.com/advisories/33397 Third Party Advisory
http://secunia.com/advisories/33418 Third Party Advisory
http://secunia.com/advisories/33419 Third Party Advisory
http://secunia.com/advisories/33568 Third Party Advisory
http://secunia.com/advisories/33820 Third Party Advisory
http://secunia.com/advisories/35074 Third Party Advisory
http://support.apple.com/kb/HT3549
http://www.securityfocus.com/bid/33060 Vdb Entry
http://www.securitytracker.com/id?1021522 Vdb Entry
http://www.us-cert.gov/cas/techalerts/TA09-133A.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/1297 Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/47655 Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9317 Signature
URL Date SRC
URL Date SRC
URL Date SRC
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html 2023-11-07
http://secunia.com/advisories/33318 2023-11-07
http://sunsolve.sun.com/search/document.do?assetkey=1-66-254208-1 2023-11-07
http://www.debian.org/security/2009/dsa-1694 2023-11-07
http://www.redhat.com/support/errata/RHSA-2009-0018.html 2023-11-07
http://www.redhat.com/support/errata/RHSA-2009-0019.html 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3E2Q6NPKT7V4VKZMSFF4ARLRVYOG4AU 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOOVZTIABA4MIFUGTAVYWO6QXSUXSST4 2023-11-07
https://usn.ubuntu.com/703-1 2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00072.html 2023-11-07
https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00184.html 2023-11-07
https://access.redhat.com/security/cve/CVE-2008-2383 2009-01-07
https://bugzilla.redhat.com/show_bug.cgi?id=478888 2009-01-07
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Invisible-island
Search vendor "Invisible-island"
 Xterm
Search vendor "Invisible-island" for product "Xterm"
 _nil_
Search vendor "Invisible-island" for product "Xterm" and version "_nil_"
-
Affected