Headline
Gentoo Linux Security Advisory 202208-22
Gentoo Linux Security Advisory 202208-22 - Multiple vulnerabilities have been discovered in xterm, the worst of which could result in denial of service. Versions less than 371 are affected.
Gentoo Linux Security Advisory GLSA 202208-22
https://security.gentoo.org/
Severity: Low
Title: xterm: Multiple Vulnerabilities
Date: August 14, 2022
Bugs: #769839, #832409
ID: 202208-22
Synopsis
Multiple vulnerabilities have been discovered in xterm, the worst of
which could result in denial of service.
Background
xterm is a terminal emulator for the X Window system.
Affected packages
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-terms/xterm < 371 >= 371
Description
Multiple vulnerabilities have been discovered in xterm. Please review
the CVE identifiers referenced below for details.
Impact
Please review the referenced CVE identifiers for details.
Workaround
There is no known workaround at this time.
Resolution
All xterm users should upgrade to the latest version:
emerge --sync
emerge --ask --oneshot --verbose “>=x11-terms/xterm-371”
References
[ 1 ] CVE-2021-27135
https://nvd.nist.gov/vuln/detail/CVE-2021-27135
[ 2 ] CVE-2022-24130
https://nvd.nist.gov/vuln/detail/CVE-2022-24130
Availability
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202208-22
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users’ machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
Copyright 2022 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
Related news
An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.
xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text.
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.