CVE-2022-45063

 

Published at: - 10-11-2022 05:15

Last modified: - 23-11-2022 04:15

Total changes: - 5

Description

xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://invisible-island.net/xterm/xterm.log.html
• https://www.openwall.com/lists/oss-security/2022/11/10/1
• https://news.ycombinator.com/item?id=33546415
• [oss-security] 20221110 CVE-2022-45063: xterm <375 code execution via font ops-Mailing List, Patch, Third Party Advisory
• [oss-security] 20221110 Re: CVE-2022-45063: xterm <375 code execution via font ops-Mailing List, Patch, Third Party Advisory
• FEDORA-2022-681bbe67b6-
• GLSA-202211-09-
• FEDORA-2022-af5f1eee2c-
• FEDORA-2022-8cf76a9ceb-

 

Keywords

NVD

 

CVE-2022-45063

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures