PT-2021-4284 · Eterm+4 · Eterm+4

Def · Published 2021-05-17 · Updated 2025-01-28 · CVE-2021-33477

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rxvt-unicode version 9.22 rxvt version 2.7.10 mrxvt version 0.5.4 Eterm version 0.9.7

Description The issue is related to improper handling of certain escape sequences, specifically ESC G Q, which can lead to code execution. This could potentially allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. A response is terminated by a newline.

Recommendations For rxvt-unicode version 9.22, consider disabling the handling of ESC G Q escape sequences until a patch is available. For rxvt version 2.7.10, restrict access to the vulnerable escape sequence handling functionality to minimize the risk of exploitation. For mrxvt version 0.5.4, avoid using the vulnerable escape sequences in the terminal until the issue is resolved. For Eterm version 0.9.7, as a temporary workaround, consider disabling the handling of ESC G Q escape sequences until a patch is available.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2021-3051

ALT-PU-2024-8071

BDU:2021-04892

CVE-2021-33477

DLA-2671-1

DLA-2681-1

DLA-2682-1

DLA-2683-1

MGASA-2021-0358

OPENSUSE-SU-2022:10222-1

OPENSUSE-SU-2024:12386-1

ROSA-SA-2025-2672

Affected Products

Alt Linux

Eterm

Mrxvt

Rxvt

Rxvt-Unicode

References · 54

• 🔥 https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html · Exploit
• 🔥 https://openwall.com/lists/oss-security/2021/05/17/1 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33477 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLPVEPBH37EBR4R54RMC6GD33J37HJXD · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33477 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2681-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUV4LDVZVW7KCGPAMFZD4ZJ4FVLPOX4C · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33477 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2681 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0358 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AO52OLNOOKOCZSJCN3R7Q25XA32BWNWP · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2671-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33477 · Security Note
• http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582&r2=1.583 · Patch