CVE-2021-33477
First published: Thu May 20 2021(Updated: )
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Eterm Project Eterm | =0.9.7 | |
| Mrxvt Project Mrxvt | =0.5.4 | |
| Rxvt-unicode Project Rxvt-unicode | =9.22 | |
| Rxvt Project Rxvt | =2.7.10 | |
| Fedoraproject Fedora | =33 | |
| Fedoraproject Fedora | =34 | |
| Debian Debian Linux | =9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cvs.schmorp.de/rxvt-unicode/Changes?view=log
- http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583
- https://git.enlightenment.org/apps/eterm.git/log/
- https://lists.debian.org/debian-lts-announce/2021/05/msg00026.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00010.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00011.html
- https://lists.debian.org/debian-lts-announce/2021/06/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AO52OLNOOKOCZSJCN3R7Q25XA32BWNWP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DUV4LDVZVW7KCGPAMFZD4ZJ4FVLPOX4C/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZWGE2RJONBEHSPCBUAW72NTRTIFKZAX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLPVEPBH37EBR4R54RMC6GD33J37HJXD/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXAKO6N6NKTR6Z6KVAPEXSZQMRU52SGA/
- https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html
- https://security.gentoo.org/glsa/202105-17
- https://security.gentoo.org/glsa/202209-07
- https://sourceforge.net/projects/materm/files/mrxvt%20source/
- https://sourceforge.net/projects/rxvt/files/rxvt-dev/
- https://www.openwall.com/lists/oss-security/2017/05/01/20
- https://www.openwall.com/lists/oss-security/2021/05/17/1
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZWGE2RJONBEHSPCBUAW72NTRTIFKZAX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLPVEPBH37EBR4R54RMC6GD33J37HJXD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAKO6N6NKTR6Z6KVAPEXSZQMRU52SGA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AO52OLNOOKOCZSJCN3R7Q25XA32BWNWP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUV4LDVZVW7KCGPAMFZD4ZJ4FVLPOX4C/
Frequently Asked Questions
What is CVE-2021-33477?
CVE-2021-33477 is a vulnerability in rxvt-unicode, rxvt, mrxvt, and Eterm that allows for potentially remote code execution due to improper handling of certain escape sequences (ESC G Q).
Which software versions are affected by CVE-2021-33477?
The affected software versions include rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7.
How severe is CVE-2021-33477?
CVE-2021-33477 has a severity rating of 8.8 (high).
How can the CVE-2021-33477 vulnerability be exploited?
The vulnerability can be exploited by sending specially crafted escape sequences (ESC G Q) to the affected software, potentially leading to remote code execution.
Are there any references available for CVE-2021-33477?
Yes, you can find references for CVE-2021-33477 at the following URLs: http://cvs.schmorp.de/rxvt-unicode/Changes?view=log, http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583, https://git.enlightenment.org/apps/eterm.git/log/
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/tags
- agent/event
- agent/severity
- agent/references
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/eterm project
- canonical/eterm project eterm
- version/eterm project eterm/0.9.7
- vendor/mrxvt project
- canonical/mrxvt project mrxvt
- version/mrxvt project mrxvt/0.5.4
- vendor/rxvt-unicode project
- canonical/rxvt-unicode project rxvt-unicode
- version/rxvt-unicode project rxvt-unicode/9.22
- vendor/rxvt project
- canonical/rxvt project rxvt
- version/rxvt project rxvt/2.7.10
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/33
- version/fedoraproject fedora/34
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0