Description
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected products
- xfree86_project / x11r64.0 – 4.0
- xfree86_project / x11r64.0.1 – 4.0.1
- xfree86_project / x11r64.0.3 – 4.0.3
- xfree86_project / x11r64.1.0 – 4.1.0
- xfree86_project / x11r64.2.0 – 4.2.0
- xfree86_project / x11r64.2.1 – 4.2.1
References
- VENDOR_ADVISORYhttp://www.debian.org/security/2003/dsa-380
- MISChttp://www.redhat.com/support/errata/RHSA-2003-067.html
- MISChttp://www.redhat.com/support/errata/RHSA-2003-066.html
- MAILING_LISThttp://marc.info/?l=bugtraq&m=104612710031920&w=2
- MISChttp://www.redhat.com/support/errata/RHSA-2003-064.html
- MISChttp://www.redhat.com/support/errata/RHSA-2003-065.html
- MISChttp://www.securityfocus.com/bid/6940
- MISChttp://www.iss.net/security_center/static/11414.php
- MISChttp://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html
- MAILING_LISThttp://www.openwall.com/lists/oss-security/2024/06/15/1