PT-2014-9097 · Rxvt Unicode+1 · Rxvt-Unicode+1

Published 1970-01-01 · Updated 2024-06-15 · CVE-2014-3121

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rxvt-unicode versions prior to 9.20

Description The issue allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands due to improper handling of OSC escape sequences. Exploitation can lead to a breach of confidentiality, integrity, and availability of protected information and can be carried out remotely.

Recommendations For versions prior to 9.20, update to version 9.20 or later to resolve the issue. As a temporary workaround, consider disabling the handling of OSC escape sequences until a patch is available. Restrict access to potentially vulnerable X window properties to minimize the risk of exploitation. Avoid using crafted text files or program outputs that may contain unprocessed escape sequences until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2015-04132

BDU:2015-04311

BDU:2015-09770

CVE-2014-3121

DSA-2925-1

MGASA-2014-0202

OPENSUSE-SU-2024:10526-1

SUSE-SU-2014_0838-1

Affected Products

Suse

Rxvt-Unicode

References · 30

• https://security-tracker.debian.org/tracker/CVE-2014-3121 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3121 · Security Note
• http://debian.org/security/2014/dsa-2925 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133166.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0202.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10526-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04132 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3121 · Security Note
• https://bdu.fstec.ru/vul/2015-09770 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0202 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3121 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133195.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04311 · Security Note