PatchTheCVExterm vulnerabilities and fixes
Recent CVEs affecting xterm, with upgrade or downgrade steps. 7 tracked.
xterm has 7 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 4. Most recent: 2023-08-14. Highest priority: CVE-2021-27135 (score 68/100).
- CVE-2023-40359 CRITICAL 9.8 UPGRADE xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e
- CVE-2022-45063 CRITICAL 9.8 UPGRADE MITIGATE xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and ther
- CVE-2022-24130 MEDIUM 5.5 UPGRADE MITIGATE xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_s
- CVE-2021-27135 CRITICAL 9.8 UPGRADE MITIGATE xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmen
- CVE-2008-2383 HIGH 9.3 DOWNGRADE CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka
- CVE-2007-2797 LOW 2.1 DOWNGRADE xterm, including 192-7.el4 in Red Hat Enterprise Linux and 208-3.1 in Debian GNU/Linux, sets the wrong group o
- CVE-2006-7236 HIGH 9.3 DOWNGRADE The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps reso
FAQ
How do I fix xterm vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xterm being exploited right now?
None of the tracked xterm CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xterm CVE should I patch first?
CVE-2021-27135 currently ranks highest (68/100): xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmen.