The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xterm | Invisible-island | nil (including) | nil (including) |
| Xterm | Ubuntu | dapper | * |
| Xterm | Ubuntu | gutsy | * |
| Xterm | Ubuntu | hardy | * |
| Xterm | Ubuntu | intrepid | * |
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
- http://secunia.com/advisories/33388
- https://usn.ubuntu.com/703-1/
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
- http://secunia.com/advisories/33388
- https://usn.ubuntu.com/703-1/