xterm security update

2009-01-07T22:24:51
ID CESA-2009:0018
Type centos
Reporter CentOS Project
Modified 2009-02-05T15:30:50

Description

CentOS Errata and Security Advisory CESA-2009:0018

The xterm program is a terminal emulator for the X Window System.

A flaw was found in the xterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside an xterm window. (CVE-2008-2383)

All xterm users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. All running instances of xterm must be restarted for the update to take effect.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2009-February/027632.html http://lists.centos.org/pipermail/centos-announce/2009-February/027633.html http://lists.centos.org/pipermail/centos-announce/2009-February/027638.html http://lists.centos.org/pipermail/centos-announce/2009-February/027652.html http://lists.centos.org/pipermail/centos-announce/2009-January/027558.html http://lists.centos.org/pipermail/centos-announce/2009-January/027559.html http://lists.centos.org/pipermail/centos-announce/2009-January/027564.html http://lists.centos.org/pipermail/centos-announce/2009-January/027565.html http://lists.centos.org/pipermail/centos-announce/2009-January/027586.html http://lists.centos.org/pipermail/centos-announce/2009-January/027587.html

Affected packages: xterm

Upstream details at: https://rhn.redhat.com/errata/RHSA-2009-0018.html