Low: Red Hat Security Advisory: xterm security update

An updated xterm package that corrects a security issue is now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team. The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and...

(mesg: error: tty device is not owned by group `tty')

xterm, including 192-7.el4 in Red Hat Enterprise Linux and 208-3.1 in Debian GNU/Linux, sets the wrong group ownership of tty devices, which allows local users to write data to other users' terminals...

Ubuntu 6.06 LTS / 6.10 / 7.04 : xfce4-terminal vulnerability (USN-497-1)

Lasse Karkkainen discovered that the Xfce Terminal did not correctly escape shell meta-characters during 'Open Link' actions. If a remote attacker tricked a user into opening a specially crafted URI, they could execute arbitrary commands with the user's privileges. Note that Tenable Network...

Fedora 7 : Terminal-0.2.6-3.fc7 (2007-1620)

Tue Aug 14 2007 Kevin Fenzi - 0.2.6-3 - Add patch for CVE-2007-3770. - Update License tag Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible...

Debian DSA-1393-1 : xfce4-terminal - insecure execution

It was discovered that xfce-terminal, a terminal emulator for the xfce environment, did not correctly escape arguments passed to the processes spawned by 'Open Link'. This allowed malicious links to execute arbitrary commands upon the local system. %NASLMINLEVEL 70300 C Tenable Network Security,...

[SECURITY] [DSA 1393-1] New xfce4-terminal packages fix arbitrary command execution

------------------------------------------------------------------------ Debian Security Advisory DSA 1393-1 [email protected] http://www.debian.org/security/ Steve Kemp October 23rd, 2007 http://www.debian.org/security/faq -...

DSA-1393-1 xfce4-terminal - insecure execution

Bulletin has no description...

SYMSA-2007-013: Lotus Notes Memory Mapped Files Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Symantec Vulnerability Research http://www.symantec.com/research Security Advisory Advisory ID: SYMSA-2007-013 Advisory Title: Lotus Notes Memory Mapped Files Vulnerability Author: Ollie Whitehouse / [email protected] Release Date: 23-10-20...

openSUSE 10 Security Update : wget (wget-1689)

This update fixes a security in wget, where evil servers could send terminal escape codes to the user calling wget. This would only affect interactive sessions. CVE-2004-1488 Additionaly a previous '.file' fix was found to be buggy and replaced. This bug could lead to '.directories' not being...

openSUSE 10 Security Update : screen (screen-2198)

A special formed UTF-8 sequence in text could be used to crash the terminal multitasker screen by overwriting memory in the heap. This is potentially exploitable to execute code. CVE-2006-4573 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Hidden administrator account the three minutes to get-vulnerability warning-the black bar safety net

On the regedit. exe everyone is familiar with, but not to the registry key set permissions, regedt32. exe the biggest advantages is the ability to the registry key set permissions. nt/2 0 0 0/xp account information in the registry HKEYLOCALMACHINE\SAM\SAM key, but in addition to the system user...

CVE-2007-4632

Cisco IOS 12.2E, 12.2F, and 12.2S places a "no login" line into the VTY configuration when an administrator makes certain changes to a 1 VTY/AUX or 2 CONSOLE setting on a device without AAA enabled, which allows remote attackers to bypass authentication and obtain a terminal session, a different...

CVE-2007-2797

xterm, including 192-7.el4 in Red Hat Enterprise Linux and 208-3.1 in Debian GNU/Linux, sets the wrong group ownership of tty devices, which allows local users to write data to other users' terminals...

[SECURITY] Fedora 7 Update: Terminal-0.2.6-3.fc7

Terminal is a lightweight and easy to use terminal emulator application for the X windowing system, with some new ideas and features that make it unique among X terminal emulators...

USN-497-1: xfce4-terminal vulnerability

Lasse Kärkkäinen discovered that the Xfce Terminal did not correctly escape shell meta-characters during "Open Link" actions. If a remote attacker tricked a user into opening a specially crafted URI, they could execute arbitrary commands with the user's privileges...

Xfce-Terminal远程命令注入漏洞

BUGTRAQ ID: 24889 CVECAN ID: CVE-2007-3770 Xfce Terminal是Xfce桌面环境的控制台工具。 Xfce Terminal在使用URL串构造命令调用时存在漏洞，远程攻击者可能利用此漏洞诱使用户执行恶意Shell命令。 Xfce-Terminal 0.2.6 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.xfce.org/ http://foo.bar/$xterm/ http://google.com/search?q=$ls&sourceid=b0rk...

[ GLSA 200708-07 ] Xfce Terminal: Remote arbitrary code execution

Gentoo Linux Security Advisory GLSA 200708-07 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity:...

Xfce terminal client unescaped shell characters vulnerability

Shell characters are not filtered on URL processing...

GLSA-200708-07 : Xfce Terminal: Remote arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-200708-07 Xfce Terminal: Remote arbitrary code execution Lasse Karkkainen discovered that the function terminalhelperexecute in file terminal-helper.c does not properly escape the URIs before processing. Impact : A remote attacker...

Xfce Terminal: Remote arbitrary code execution

Background Xfce Terminal is a console tool for the Xfce desktop environment. Description Lasse Karkkainen discovered that the function terminalhelperexecute in file terminal-helper.c does not properly escape the URIs before processing. Impact A remote attacker could entice a user to open a...