CVE-2011-2198: Input Validation
An memory exhaustion flaw was found in the way VTE, a terminal emulator widget, processed certain character sequences. A remote attacker could provide a specially-crafted file, which once opened in a terminal using the VTE terminal emulator could lead to excessive memory and CPU consumption.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629688 [2] https://bugzilla.gnome.org/showbug.cgi?id=652124
Other sources
The "insert-blank-characters" capability in caps.c in gnome-terminal (vte) before 0.28.1 allows remote authenticated users to cause a denial of service (CPU and memory consumption and crash) via a crafted file, as demonstrated by a file containing the string "\033[100000000000000000@".
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2198?
CVE-2011-2198 has a medium severity level due to its potential for memory exhaustion and resource consumption.
How do I fix CVE-2011-2198?
To mitigate CVE-2011-2198, update VTE to version 0.28.1 or higher.
Which software is affected by CVE-2011-2198?
CVE-2011-2198 affects the VTE terminal emulator, GNOME Terminal, and specific versions of openSUSE and Oracle Solaris.
Can CVE-2011-2198 be exploited remotely?
Yes, CVE-2011-2198 can be exploited by a remote attacker through specially-crafted files.
What are the symptoms of CVE-2011-2198 being exploited?
Exploitation of CVE-2011-2198 can lead to excessive memory and CPU consumption when opening affected files in the terminal.