CVE-2017-3158

CVE-2017-3158 affects Apache Guacamole’s terminal emulator, with vulnerable versions 0.9.5 through 0.9.10-incubating. The issue is a race condition where overlapping writes of blocks of printed data can cause packet data to be misread as the packet length, leading to writes beyond the end of a st...

CVE-2017-3158

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end o...

CVE-2017-3158

Removed by vendor...

[SECURITY] Fedora 27 Update: shellinabox-2.20-5.fc27

Shell In A Box implements a web server that can export arbitrary command li ne tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugins...

[SECURITY] Fedora 26 Update: shellinabox-2.20-5.fc26

Shell In A Box implements a web server that can export arbitrary command li ne tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser and does not require any additional browser plugins...

CVE-2017-16544

It was found that the tab auto-completion feature of BusyBox did not sanitize filenames, leading to execution of arbitrary escape sequences in the terminal emulator. Exploitation of this flaw by an attacker could potentially result in code execution, arbitrary file writes, or other attacks under...

WEBrick Improper Input Validation vulnerability

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

GHSA-6MQ2-37J5-W6R6 WEBrick Improper Input Validation vulnerability

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name...

CVE-2017-10784

Removed by vendor...

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name...

CVE-2017-10784

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name...

[SECURITY] Fedora 24 Update: lxterminal-0.3.0-3.fc24

LXterminal is a VTE-based terminal emulator with support for multiple tabs. It is completely desktop-independent and does not have any unnecessary dependencies. In order to reduce memory usage and increase the performance all instances of the terminal are sharing a single process...

[SECURITY] Fedora 25 Update: lxterminal-0.3.0-3.fc25

LXterminal is a VTE-based terminal emulator with support for multiple tabs. It is completely desktop-independent and does not have any unnecessary dependencies. In order to reduce memory usage and increase the performance all instances of the terminal are sharing a single process...

Debian DLA-935-1 : lxterminal security update

It was discovered that there was a local denial of service vulnerability in lxterminal, the terminal emulator for the LXDE desktop environment. This was caused by an insecure use of temporary files for a socket file. For Debian 7 'Wheezy', this issue has been fixed in lxterminal version...

RubyGems: Escape sequence injection in "summary" field

Seems we can include any escape sequence in the "summary" field of gemspec. This allows attackers to inject escape sequences to a victim's terminal emulator. How to attack 1 An attacker creates a gem with summary string that includes malicious escape sequences, and push it to rubygems.org. 2 A...

Debian DSA-3712-1 : terminology - security update

Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extract...

The vulnerabilities of the RUMBA terminal emulator allow a hacker to execute arbitrary code.

The multiple vulnerabilities of the RUMBA terminal emulator are caused by an overflow in the stack buffer. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code using values from the NetworkName property in ObjectXSNAConfig.ObjectXSNAConfig iconfig.dll, the CPName...

The vulnerability of the RUMBA terminal emulator allows a hacker to execute arbitrary code.

The vulnerability of the PlayMacro function in ObjectXMacro.ObjectXMacro WdMacCtl.ocx, a terminal emulator RUMBA, is caused by buffer overflow in the stack. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code using a long MacroName argument...

Terminal Emulator for Android - Exported components, Native code usage, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Terminal Emulator for Android published at the 'play' market has multiple vulnerabilities...