xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-xtermalma-upgrade-xterm-resize | May 22, 2025 | Nov 10, 2022 | |
| Debian | debian-upgrade-xterm | Jul 30, 2024 | Nov 10, 2022 | |
| Dell Powerstore Dsa2023173 | dell-powerstoreos-upgrade-latest | Oct 23, 2025 | Jun 21, 2023 | |
| Gentoo Linux | gentoo-linux-upgrade-x11-terms-xterm | Nov 23, 2022 | Nov 10, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-xtermoracle-linux-upgrade-xterm-resize | May 26, 2025 | Nov 10, 2022 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-xtermredhat-upgrade-xterm-debuginforedhat-upgrade-xterm-debugsourceredhat-upgrade-xterm-resizeredhat-upgrade-xterm-resize-debuginfo | May 15, 2025 | Nov 10, 2022 | |
| Rocky_linux | rocky-upgrade-xtermrocky-upgrade-xterm-debuginforocky-upgrade-xterm-debugsourcerocky-upgrade-xterm-resizerocky-upgrade-xterm-resize-debuginfo | Oct 6, 2025 | Oct 4, 2025 | |
| Suse | — | suse-upgrade-xtermsuse-upgrade-xterm-bin | Jan 27, 2023 | Nov 10, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub