hanterm security update

ID CESA-2009:0019-01
Type centos
Reporter CentOS Project
Modified 2009-02-02T23:25:09


CentOS Errata and Security Advisory CESA-2009:0019-01

Hanterm is a replacement for xterm, a X Window System terminal emulator, that supports Hangul input and output.

A flaw was found in the Hanterm handling of Device Control Request Status String (DECRQSS) escape sequences. An attacker could create a malicious text file (or log entry, if unfiltered) that could run arbitrary commands if read by a victim inside a Hanterm window. (CVE-2008-2383)

All hanterm-xf users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. All running instances of hanterm must be restarted for the update to take effect.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2009-February/027610.html

Affected packages: hanterm-xf

Upstream details at: https://rhn.redhat.com/errata/rh21as-errata.html