PT-2014-9097 · Rxvt Unicode+1 · Rxvt-Unicode+1

Publicado 1970-01-01 · Atualizado 2024-06-15 · CVE-2014-3121

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rxvt-unicode versions prior to 9.20

Description The issue allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands due to improper handling of OSC escape sequences. Exploitation can lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For versions prior to 9.20, update to version 9.20 or later to resolve the issue. As a temporary workaround, consider disabling the handling of OSC escape sequences until a patch is available. Restrict access to potentially vulnerable X window properties to minimize the risk of exploitation. Avoid using crafted text files or program outputs that may contain unprocessed escape sequences until the issue is resolved.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2015-04132

BDU:2015-04311

BDU:2015-09770

CVE-2014-3121

DSA-2925-1

MGASA-2014-0202

OPENSUSE-SU-2024:10526-1

SUSE-SU-2014_0838-1

Produtos afetados

Suse

Rxvt-Unicode

Referências · 30

• https://security-tracker.debian.org/tracker/CVE-2014-3121 · Aviso do Fabricante
• http://seclists.org/oss-sec/2014/q2/204 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-3121 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-3121 · Nota de Segurança
• http://debian.org/security/2014/dsa-2925 · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133166.html · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2014-0202.html · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/05/01/8 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10526-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-3121 · Nota
• https://bugzilla.novell.com/876101 · Nota
• https://bdu.fstec.ru/vul/2015-04132 · Nota de Segurança
• http://security.gentoo.org/glsa/glsa-201406-18.xml · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3121 · Nota de Segurança