First published: Wed Dec 07 2022(Updated: )
rxvt-unicode 9.25 and 9.26 are vulnerable to remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. The "background" extension is automatically loaded if certain X resources are set such as 'transparent' (see the full list at the top of src/perl/background). So it is possible to be using this extension without realizing it. This is accidentally fixed on version 9.30, and 9.29, it appears to not be exploitable, but only due to another bug (not a security bug). The actual bug which makes this not vulnerable on 9.30 is simply a wrong number in "on_osc_seq".
Credit: patrick@puiterwijk.org patrick@puiterwijk.org
Affected Software | Affected Version | How to fix |
---|---|---|
Rxvt-unicode Project Rxvt-unicode | =9.25 | |
Rxvt-unicode Project Rxvt-unicode | =9.26 | |
Fedoraproject Extra Packages For Enterprise Linux | =8.0 | |
Fedoraproject Fedora | =37 | |
redhat/rxvt-unicode | <9.30 | 9.30 |
=9.25 | ||
=9.26 | ||
=8.0 | ||
=37 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2022-4170 is a vulnerability in the rxvt-unicode package that allows remote code execution when an attacker can control the data written to the user's terminal and certain options are set.
CVE-2022-4170 has a severity rating of 9.8 (Critical).
The affected versions include rxvt-unicode 9.25 and 9.26, Extra Packages for Enterprise Linux 8.0, and Fedora 37.
To fix CVE-2022-4170, it is recommended to upgrade to rxvt-unicode version 9.30 or higher.
Additional information can be found at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=2151597), [link2](https://www.openwall.com/lists/oss-security/2022/12/05/1), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2151598).