Updated rvxt-unicode, mxrvt, eterm packages fix security vulnerability

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow potentially remote code execution because of improper handling of certain escape sequences ESC G Q. A response is terminated by a newline CVE-2021-33477...

MGASA-2021-0358 Updated rvxt-unicode, mxrvt, eterm packages fix security vulnerability

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow potentially remote code execution because of improper handling of certain escape sequences ESC G Q. A response is terminated by a newline CVE-2021-33477...

The vulnerability of the encoding.c component of the GNU Screen window manager allows a hacker to introduce or modify arguments, thereby enabling them to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the encoding.c component of the GNU Screen terminal manager is related to incorrect processing of UTF-8 character sequences. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Remote Code Execution

fail2ban is vulnerable to remote code execution. The mailing action mail-whois command mail from mailutils package used in mail actions like mail-whois can execute command allows an attacker to execute arbitrary commands due to unescaped sequences \n in foreign input...

openSUSE 15 Security Update : libX11 (openSUSE-SU-2021:1897-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1897-1 advisory. - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor...

CVE-2021-32749

fail2ban is a daemon to ban hosts that cause multiple authentication errors. In versions 0.9.7 and prior, 0.10.0 through 0.10.6, and 0.11.0 through 0.11.2, there is a vulnerability that leads to possible remote code execution in the mailing action mail-whois. Command mail from mailutils package...

fail2ban -- possible RCE vulnerability in mailing action using mailutils

Jakub Żoczek reports: Command mail from mailutils package used in mail actions like mail-whois can execute command if unescaped sequences \n are available in "foreign" input for instance in whois output...

CVE-2021-20511

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 198300...

Advisory ROSA-SA-2021-1920

Software: minicom 2.6.2 OS: Cobalt 7.9 CVE-ID: CVE-2017-7467 CVE-Crit: CRITICAL CVE-DESC: A buffer overflow error was detected in the way minicom pre-2.7.1 handled VT100 escape sequences. A malicious terminal device could potentially exploit this vulnerability to crash minicom or execute arbitrar...

VulnCheck KEV: CVE-2009-4490

minihttpd 1.19 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

Medium: glibc

Issue Overview: In the GNU C Library aka glibc or libc6 through 2.29, proceednextnode in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match. CVE-2019-9169 A flaw was found in glibc. If an attacker provides the iconv function with invalid...

Debian DLA-2682-1 : mrxvt security update

mrxvt, lightweight multi-tabbed X terminal emulator, allowed potentially remote code execution because of improper handling of certain escape sequences ESC G Q. For Debian 9 stretch, this problem has been fixed in version 0.5.4-2+deb9u1. We recommend that you upgrade your mrxvt packages. For the...

Debian DLA-2681-1 : eterm security update

eterm, an enlightened terminal emulator, allowed potentially remote code execution because of improper handling of certain escape sequences ESC G Q. For Debian 9 stretch, this problem has been fixed in version 0.9.6-5+deb9u1. We recommend that you upgrade your eterm packages. For the detailed...

Debian DLA-2683-1 : rxvt security update

rxvt, VT102 terminal emulator for the X Window System, allowed potentially remote code execution because of improper handling of certain escape sequences ESC G Q. For Debian 9 stretch, this problem has been fixed in version 1:2.7.10-7+deb9u2. We recommend that you upgrade your rxvt packages. For...

[SECURITY] [DLA 2683-1] rxvt security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2683-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta June 09, 2021 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

SUSE: Security Advisory (SUSE-SU-2019:13931-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-2671-1 : rxvt-unicode security update

rxvt-unicode allow potentially remote code execution because of improper handling of certain escape sequences ESC G Q. A response is terminated by a newline. For Debian 9 stretch, this problem has been fixed in version 9.22-1+deb9u1. We recommend that you upgrade your rxvt-unicode packages. For t...

[SECURITY] [DLA 2671-1] rxvt-unicode security update

----------------------------------------------------------------------- Debian LTS Advisory DLA-2671-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta May 30, 2021 https://wiki.debian.org/LTS - -----------------------------------------------------------------------...

CVE-2021-31535

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request intended for server-side color lookup contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allow...

rxvt-unicode: User-assisted execution of arbitrary code

Background rxvt-unicode urxvt is a clone of the rxvt terminal emulator. Description It was discovered that rxvt-unicode did not properly handle certain escape sequences. Impact A remote attacker could entice a user to run a program where attacker controls the output inside a rxvt terminal window,...