UBUNTU-CVE-2021-33477: High severity ubuntu/eterm vulnerability

Published May 20, 2021

Updated

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.

Affected Software

8 affected components

ubuntu/eterm*

ubuntu/mrxvt*

ubuntu/rxvt*

ubuntu/rxvt-unicode*

ubuntu/eterm*

ubuntu/rxvt-unicode*

ubuntu/eterm*

ubuntu/rxvt-unicode*

Event History

May 20, 2021

CVE Published

via OSV·08:15 PM

Data Sourced

via OSV·08:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Does exploitation require user interaction or elevated privileges?

The CVSS vector indicates no user interaction is required and the attack complexity is low. It also indicates that an attacker needs low privileges, rather than elevated privileges.

Which systems should be prioritized for review?

Prioritize systems using Eterm 0.9.7, rxvt 2.7.10, rxvt-unicode 9.22, or mrxvt 0.5.4. The affected software list identifies the Ubuntu Eterm, rxvt-unicode, mrxvt, and rxvt packages.

UBUNTU-CVE-2021-33477: High severity ubuntu/eterm vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploitation require user interaction or elevated privileges?

Which systems should be prioritized for review?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require user interaction or elevated privileges?

Which systems should be prioritized for review?