CVE-2021-33477: High severity eterm vulnerability

Published May 20, 2021

Updated

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.

Affected Software

7 affected components

Eterm Project Eterm=0.9.7

Mrxvt Project Mrxvt=0.5.4

Rxvt-unicode Project Rxvt-unicode=9.22

Rxvt Project Rxvt=2.7.10

Fedoraproject Fedora=33

Fedoraproject Fedora=34

Debian Debian Linux=9.0

Remediation

Patch Available

http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583

Event History

May 20, 2021

CVE Published

via MITRE·07:16 PM

Data Sourced

via MITRE·07:16 PM

Description

Frequently Asked Questions

What is CVE-2021-33477?

CVE-2021-33477 is a vulnerability in rxvt-unicode, rxvt, mrxvt, and Eterm that allows for potentially remote code execution due to improper handling of certain escape sequences (ESC G Q).

Which software versions are affected by CVE-2021-33477?

The affected software versions include rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7.

How severe is CVE-2021-33477?

CVE-2021-33477 has a severity rating of 8.8 (high).

How can the CVE-2021-33477 vulnerability be exploited?

The vulnerability can be exploited by sending specially crafted escape sequences (ESC G Q) to the affected software, potentially leading to remote code execution.

Are there any references available for CVE-2021-33477?

Yes, you can find references for CVE-2021-33477 at the following URLs: http://cvs.schmorp.de/rxvt-unicode/Changes?view=log, http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583, https://git.enlightenment.org/apps/eterm.git/log/