CVE-2003-0063 The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's t...
HighCVSS 7.5
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xfree86 project x11r6 | = 4.0 | No fix listed |
| xfree86 project x11r6 | = 4.0.1 | No fix listed |
| xfree86 project x11r6 | = 4.0.3 | No fix listed |
| xfree86 project x11r6 | = 4.1.0 | No fix listed |
| xfree86 project x11r6 | = 4.2.0 | No fix listed |
| xfree86 project x11r6 | = 4.2.1 | No fix listed |
| xfree86 | <= 4.2.0 | No fix listed |
References
- 20030224 Terminal Emulator Security Issues mailing-list vendor-advisory
- 20030224 Terminal Emulator Security Issues mailing-list
- DSA-380 vendor-advisory
- terminal-emulator-window-title(11414) vdb-entry vendor-advisory
- [oss-security] 20240615 iTerm2 3.5.x title reporting bug mailing-list
- RHSA-2003:064 vendor-advisory
- RHSA-2003:065 vendor-advisory
- RHSA-2003:066 vendor-advisory
- RHSA-2003:067 vendor-advisory
- 6940 vdb-entry