CVE-2021-27135: Critical severity xterm vulnerability
A crash was reported in xterm prior to patch #366 when processing a specially crafted sequence of combining characters. The cause is an out of bounds write, which may be exploitable to cause arbitrary code execution.
https://www.openwall.com/lists/oss-security/2021/02/09/7 https://invisible-island.net/xterm/xterm.log.html
Other sources
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-27135?
The severity of CVE-2021-27135 is classified as high due to the potential for arbitrary code execution.
How do I fix CVE-2021-27135?
To fix CVE-2021-27135, update xterm to version 366 or later for affected distributions.
What systems are affected by CVE-2021-27135?
CVE-2021-27135 affects various versions of xterm on Debian, Red Hat, and Fedora systems.
Can CVE-2021-27135 be exploited remotely?
CVE-2021-27135 has the potential for exploitation, but whether it can be exploited remotely depends on the configurations and context of the application.
What are the symptoms of exploitation of CVE-2021-27135?
Exploitation of CVE-2021-27135 could result in application crashes or, in a successful scenario, arbitrary code execution on the affected system.