CAN-2004-0814: Linux terminal layer races

Linux 2.6.9 fixes a set of race conditions in the Linux terminal subsystem which are believed to go back to 2.2 kernels if not earlier. The race shows up problematically in two places. Firstly a user can cause crashes and other undefined behaviour by issuing a TIOCSETLD ioctl on a terminal...

Debian DSA-472-1 : fte - several vulnerabilities

Steve Kemp and Jaguar discovered a number of buffer overflow vulnerabilities in vfte, a version of the fte editor which runs on the Linux console, found in the package fte-console. This program is setuid root in order to perform certain types of low-level operations on the console. Due to these...

Debian DSA-496-1 : eterm - missing input sanitising

H.D. Moore discovered several terminal emulator security issues. One of them covers escape codes that are interpreted by the terminal emulator. This could be exploited by an attacker to insert malicious commands hidden for the user, who has to hit enter to continue, which would also execute the...

Debian DSA-408-1 : screen - integer overflow

Timo Sirainen reported a vulnerability in screen, a terminal multiplexor with VT100/ANSI terminal emulation, that can lead an attacker to gain group utmp privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

multi-gnome-terminal information leak

Keystrokes are logged to user's home in debugging mode...

[ GLSA 200409-10 ] multi-gnome-terminal: Information leak

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-10 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - -...

GLSA-200409-10 : multi-gnome-terminal: Information leak

The remote host is affected by the vulnerability described in GLSA-200409-10 multi-gnome-terminal: Information leak multi-gnome-terminal contains debugging code that has been known to output active keystrokes to a potentially unsafe location. Output has been seen to show up in the...

multi-gnome-terminal: Information leak

Background multi-gnome-terminal is an enhanced terminal emulator that is derived from gnome-terminal. Description multi-gnome-terminal contains debugging code that has been known to output active keystrokes to a potentially unsafe location. Output has been seen to show up in the '.xsession-errors...

CVE-2003-0070

VTE, as used by default in gnome-terminal terminal emulator 2.2 and as an option in gnome-terminal 2.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containin...

CVE-2003-0065

CVE-2003-0065 concerns the uxterm terminal emulator window-title reporting vulnerability. A malicious escape sequence can modify the terminal window title and, when echoed back to the command line, enable attacker-controlled input to be executed by the user’s shell. The related literature documen...

CVE-2003-0068

The CVE-2003-0068 issue affects the Eterm terminal emulator up to version 0.9.1, where a crafted escape sequence could modify the window title and then be re-inserted into the command line, enabling arbitrary command execution in the user’s terminal. Public advisories (including Debian DSA-496 an...

CVE-2003-0069

CVE-2023-30844 affects Mutagen real-time file sync/forwarding. Before v0.16.6 and v0.17.1 (and v0.17.1 in mutagen-compose), Mutagen’s list and monitor commands do not neutralize control characters from remote endpoints, risking terminal corruption if these characters appear in error messages or p...

CVE-2002-0444

Technical details about CVE-2002-0444 are not provided in the supplied documents. The description notes that Windows 2000 Terminal Server SYSVOL policy application can fail when connections exceed a maximum; monitor for official updates.

CVE-2003-0063

The vulnerability refers to the xterm terminal emulator in XFree86 4.2.0 and earlier. The issue allows an attacker to change the window title via a specific escape sequence and then insert it back into the user’s shell, potentially leading to execution of arbitrary commands. Connected documents c...

CVE-2003-0064

The CVE concerns dtterm and related terminals’ Window Title Reporting feature. An attacker can craft an escape sequence that places the current window title on the command line, and the user must press Enter for the command to execute, enabling arbitrary command execution on the vulnerable host. ...

CVE-2003-0020

Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences...

CVE-2003-0066

Removed by vendor...

CVE-2003-0077

The hanterm hanterm-xf terminal emulator 2.0.5 and earlier, and possibly later versions, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious...

CVE-2003-0064

The dtterm terminal emulator allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitra...

CVE-2003-0070

CVE-2003-0070 affects VTE as used by gnome-terminal; the vte_sequence_handler_window_manipulation routine fails to sanitize certain escape sequences, allowing an attacker to modify the window title and inject it back into the command line, potentially enabling arbitrary command execution. This is...