xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xtermUpgrade xterm-resize | May 22, 2025 | Nov 10, 2022 |
| Debian | — | Upgrade xterm | Jul 30, 2024 | Nov 10, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Gentoo Linux | — | Upgrade x11-terms/xterm. | Nov 23, 2022 | Nov 10, 2022 |
| Oracle_linux | — | Upgrade xtermUpgrade xterm-resize | May 26, 2025 | Nov 10, 2022 |
| Redhat_linux | — | Upgrade xterm-resizeUpgrade xterm-debugsourceUpgrade xterm-resize-debuginfoUpgrade xterm-debuginfoNo solution existsUpgrade xterm | May 15, 2025 | Nov 10, 2022 |
| Rocky_linux | — | Upgrade xterm-resize-debuginfoUpgrade xterm-debugsourceUpgrade xterm-resizeUpgrade xtermUpgrade xterm-debuginfo | Oct 6, 2025 | Oct 4, 2025 |
| Suse | — | Upgrade xterm-binUpgrade xterm | Jan 27, 2023 | Nov 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub