Zutty: Arbitrary Code Execution

Background

Zutty is an X terminal emulator rendering through OpenGL ES Compute Shaders.

Description

Zutty does not correctly handle invalid DECRQSS commands, which can be exploited to run arbitrary commands in the terminal.

Impact

Untrusted text written to the Zutty terminal can achieve arbitrary code execution.

Workaround

There is no known workaround at this time.

Resolution

All Zutty users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=x11-terms/zutty-0.13"