It was reported to Ubuntu that vte regressed the fix for CVE-2003-0070 in the following upstream commit:
http://git.gnome.org/browse/vte/commit/?id=58bc3a942f198a1a8788553ca72c19d7c1702b74
This would allow for an information disclosure of the window title of the gnome-terminal.
This issue does not affect Red Hat Enterprise Linux 5 or earlier, which still replace the contents of the window title with "LTerminal", rather than "l[contents of terminal window]"; as demonstrated with:
$ echo -e "\e[21t"
https://www.cve.org/CVERecord?id=CVE-2024-37535 states: to CVE-2000-0476. https://gitlab.gnome.org/GNOME/vte/-/issues/2786 explains further: The ANSI escape sequence "e[4;;t" can be used to resize the terminal window, where "" is the height and ""is the width. By providing a large number such as 65535 for both values will lead to a local denial of service, where the whole machine can be frozen.
This same vulnerability found was in XTerm back in 2000. The CVE for the vulnerability in XTerm is CVE-2000-0476
Steps to reproduce:
Open gnome-terminal Execute printf "e[4;65535;65535t" in the terminal -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
It was reported to Ubuntu that vte regressed the fix for CVE-2003-0070 in the following upstream commit:
http://git.gnome.org/browse/vte/commit/?id=58bc3a942f198a1a8788553ca72c19d7c1702b74
This would allow for an information disclosure of the window title of the gnome-terminal.
This issue does not affect Red Hat Enterprise Linux 5 or earlier, which still replace the contents of the window title with "LTerminal", rather than "l[contents of terminal window]"; as demonstrated with:
$ echo -e "\e[21t"