CVE-2004-2215 — File Descriptor Leak in Rxvt-unicode

CWE-403 — File Descriptor Leak5 documents5 sources
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 77.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Rxvt-unicode Project Rxvt-unicodeDebian Rxvt-unicodeMarc Lehmann Rxvt-unicode
Timeline
PublishedDec 31
Latest updateApr 29

Description

RXVT-Unicode 3.4 and 3.5 does not properly close file descriptors, which allows local users to access the terminals of other users and possibly gain privileges.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/rxvt-unicode< rxvt-unicode 3.8-1 (bookworm)

Patches

Patch: secunia.com ↗Patch: www.osvdb.org ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-h338-p5fc-8vgw: RXVT-Unicode 3↗2022-04-29
▶
OSV
CVE-2004-2215: RXVT-Unicode 3↗2004-12-31
▶

📋Vendor Advisories

1
Debian
CVE-2004-2215: rxvt-unicode - RXVT-Unicode 3.4 and 3.5 does not properly close file descriptors, which allows ...↗2004
▶

📐Framework References

1
CWE
Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')↗
▶