CVE-2022-45063: Command Injection
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xtermto a version that resolves this vulnerability.Fixed in 375
Event History
Frequently Asked Questions
What is the severity of CVE-2022-45063?
CVE-2022-45063 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2022-45063?
To fix CVE-2022-45063, upgrade xterm to version 375 or later.
What does CVE-2022-45063 affect?
CVE-2022-45063 affects xterm prior to version 375 and certain versions of Fedora 35, 36, and 37.
Can CVE-2022-45063 exploit command execution?
Yes, CVE-2022-45063 can lead to command execution through crafted font operations.
Is CVE-2022-45063 commonly found in default configurations?
No, font operations that trigger CVE-2022-45063 are generally not allowed in the default configurations of some Linux distributions.