CVE-2022-4170: Critical severity node-has-unicode vulnerability
rxvt-unicode 9.25 and 9.26 are vulnerable to remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
The "background" extension is automatically loaded if certain X resources are set such as 'transparent' (see the full list at the top of src/perl/background). So it is possible to be using this extension without realizing it.
This is accidentally fixed on version 9.30, and 9.29, it appears to not be exploitable, but only due to another bug (not a security bug). The actual bug which makes this not vulnerable on 9.30 is simply a wrong number in "onoscseq".
Other sources
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4170?
CVE-2022-4170 is a vulnerability in the rxvt-unicode package that allows remote code execution when an attacker can control the data written to the user's terminal and certain options are set.
How severe is CVE-2022-4170?
CVE-2022-4170 has a severity rating of 9.8 (Critical).
Which software versions are affected by CVE-2022-4170?
The affected versions include rxvt-unicode 9.25 and 9.26, Extra Packages for Enterprise Linux 8.0, and Fedora 37.
How can I fix CVE-2022-4170?
To fix CVE-2022-4170, it is recommended to upgrade to rxvt-unicode version 9.30 or higher.
Where can I find more information about CVE-2022-4170?
Additional information can be found at the following references: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=2151597), [link2](https://www.openwall.com/lists/oss-security/2022/12/05/1), [link3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2151598).