CVE-2022-4170
First published: Wed Dec 07 2022(Updated: )
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rxvt-unicode Project Rxvt-unicode | =9.25 | |
| Rxvt-unicode Project Rxvt-unicode | =9.26 | |
| Fedoraproject Extra Packages For Enterprise Linux | =8.0 | |
| Fedoraproject Fedora | =37 | |
| redhat/rxvt-unicode | <9.30 | 9.30 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-4170?
CVE-2022-4170 is a vulnerability in the rxvt-unicode package that allows remote code execution when an attacker can control the data written to the user's terminal and certain options are set.
How severe is CVE-2022-4170?
CVE-2022-4170 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2022-4170?
The affected versions include rxvt-unicode 9.25 and 9.26, Extra Packages for Enterprise Linux 8.0, and Fedora 37.
How can I fix CVE-2022-4170?
To fix CVE-2022-4170, it is recommended to upgrade to rxvt-unicode version 9.30 or higher.
Where can I find more information about CVE-2022-4170?
Additional information can be found at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=2151597), [link2](https://www.openwall.com/lists/oss-security/2022/12/05/1), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2151598).
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/mitre-cve
- collector/nvd-api
- collector/nvd-index
- collector/redhat-bugzilla
- alias/CVE-2022-4170
- vendor/rxvt-unicode project
- canonical/rxvt-unicode project rxvt-unicode
- version/rxvt-unicode project rxvt-unicode/9.25
- version/rxvt-unicode project rxvt-unicode/9.26
- vendor/fedoraproject
- canonical/fedoraproject extra packages for enterprise linux
- version/fedoraproject extra packages for enterprise linux/8.0
- canonical/fedoraproject fedora
- version/fedoraproject fedora/37
- package-manager/redhat