CVE-2021-33477
 
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
rxvt-unicode versión 9.22, rxvt versión 2.7.10, mrxvt versión 0.5.4 y Eterm versión 0.9.7 permiten una ejecución de código (potencialmente remoto) debido al manejo inapropiado de determinadas secuencias de escape (ESC GQ). Una respuesta es terminada con una nueva línea
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2021-05-20 CVE Reserved
- 2021-05-20 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-10-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-755: Improper Handling of Exceptional Conditions
CAPEC
References (20)
URL | Tag | Source |
---|---|---|
http://cvs.schmorp.de/rxvt-unicode/Changes?view=log | Third Party Advisory | |
https://git.enlightenment.org/apps/eterm.git/log | Third Party Advisory | |
https://lists.debian.org/debian-lts-announce/2021/05/msg00026.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2021/06/msg00010.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2021/06/msg00011.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2021/06/msg00012.html | Mailing List | |
https://sourceforge.net/projects/materm/files/mrxvt%20source | Product | |
https://sourceforge.net/projects/rxvt/files/rxvt-dev | Product | |
https://www.openwall.com/lists/oss-security/2017/05/01/20 | Mailing List |
URL | Date | SRC |
---|---|---|
https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html | 2024-08-03 | |
https://www.openwall.com/lists/oss-security/2021/05/17/1 | 2024-08-03 |
URL | Date | SRC |
---|---|---|
http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583 | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Eterm Project Search vendor "Eterm Project" | Eterm Search vendor "Eterm Project" for product "Eterm" | 0.9.7 Search vendor "Eterm Project" for product "Eterm" and version "0.9.7" | - |
Affected
| ||||||
Mrxvt Project Search vendor "Mrxvt Project" | Mrxvt Search vendor "Mrxvt Project" for product "Mrxvt" | 0.5.4 Search vendor "Mrxvt Project" for product "Mrxvt" and version "0.5.4" | - |
Affected
| ||||||
Rxvt-unicode Project Search vendor "Rxvt-unicode Project" | Rxvt-unicode Search vendor "Rxvt-unicode Project" for product "Rxvt-unicode" | 9.22 Search vendor "Rxvt-unicode Project" for product "Rxvt-unicode" and version "9.22" | - |
Affected
| ||||||
Rxvt Project Search vendor "Rxvt Project" | Rxvt Search vendor "Rxvt Project" for product "Rxvt" | 2.7.10 Search vendor "Rxvt Project" for product "Rxvt" and version "2.7.10" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|