Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2008-1142: rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow loc

20
Routine
LOW 3.7UPGRADEUPGRADEUPGRADE

CVE-2008-1142 is a low-severity flaw (CVSS 3.7) affecting aterm, eterm, mrxvt. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score3.7 (Low)
EPSS exploit chance0.4% (top 70%)
CISA exploited listNo
WeaknessCWE-264
Published2008-04-07
Last modified2026-06-16
Publisher (CNA): MITRE · Vendor: aterm · eterm · mrxvt · multi-aterm · rxvt · rxvt-unicode

Share: LinkedIn · X · Reddit

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

aterm aterm UPGRADE
Affected: <= 1.0.0 · 0.1.0 · 0.1.1 · 0.2.0 · 0.3.0 · 0.3.1 · 0.3.2 · 0.3.3
Fixed in: newer than 1.0.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy aterm || rpm -q aterm || aterm --version
2. UPGRADE to newer than 1.0.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade aterm
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade aterm
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
eterm eterm UPGRADE
Affected: <= 0.9.3 · 0.9.2
Fixed in: newer than 0.9.3
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy eterm || rpm -q eterm || eterm --version
2. UPGRADE to newer than 0.9.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade eterm
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade eterm
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
mrxvt mrxvt UPGRADE
Affected: <= 0.5.2 · 0.4.2
Fixed in: newer than 0.5.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy mrxvt || rpm -q mrxvt || mrxvt --version
2. UPGRADE to newer than 0.5.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade mrxvt
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade mrxvt
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
multi-aterm multi-aterm UPGRADE
Affected: <= 0.2 · 0.0.1 · 0.0.3 · 0.0.4 · 0.0.5 · 0.1
Fixed in: newer than 0.2
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy multi-aterm || rpm -q multi-aterm || multi-aterm --version
2. UPGRADE to newer than 0.2 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade multi-aterm
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade multi-aterm
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
rxvt rxvt UPGRADE
Affected: <= 2.7.9 · 2.6.1 · 2.6.2 · 2.6.3 · 2.6.4 · 2.7.5 · 2.7.6 · 2.7.7
Fixed in: newer than 2.7.9
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy rxvt || rpm -q rxvt || rxvt --version
2. UPGRADE to newer than 2.7.9 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade rxvt
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade rxvt
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
rxvt-unicode rxvt-unicode UPGRADE
Affected: <= 9.01 · 1.0 · 1.1 · 1.2 · 1.3 · 1.4 · 1.5 · 1.6
Fixed in: newer than 9.01
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy rxvt-unicode || rpm -q rxvt-unicode || rxvt-unicode --version
2. UPGRADE to newer than 9.01 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade rxvt-unicode
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade rxvt-unicode
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2008-1142?

aterm: upgrade to newer than 1.0.0; eterm: upgrade to newer than 0.9.3; mrxvt: upgrade to newer than 0.5.2. Exact commands for each OS are on this page.

Is CVE-2008-1142 being exploited?

CVE-2008-1142 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2008-1142 affect?

CVE-2008-1142 affects aterm, eterm, mrxvt. Severity is low (CVSS 3.7). rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also

How urgent is CVE-2008-1142?

Priority 20/100. No elevated risk signals yet.

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.