CVE-2006-7236
published 2009-01-02CVE-2006-7236: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to…
PriorityP350critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
7.47%
93.7th percentile
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xterm | < xterm 238-1 (bookworm) | xterm 238-1 (bookworm) |
| invisible-island | xterm | — | — |
| invisible-island | xterm | >= 0 < 238-1 | 238-1 |
| invisible-island | xterm | >= 0 < 238-1 | 238-1 |
| invisible-island | xterm | >= 0 < 238-1 | 238-1 |
| invisible-island | xterm | >= 0 < 238-1 | 238-1 |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv9.3CRITICAL
vendor_debian9.3MEDIUM
vendor_redhat9.3CRITICAL
vendor_ubuntu9.3CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
xterm vulnerabilities
vendor_ubuntu·2009-01-06·CVSS 9.3
CVE-2008-2383 [CRITICAL] xterm vulnerabilities
Title: xterm vulnerabilities
Summary: xterm vulnerabilities
Paul Szabo discovered that the DECRQSS escape sequences were not handled
correctly by xterm. Additionally, window title operations were also not
safely handled. If a user were tricked into viewing a specially crafted
series of characters while in xterm, a remote attacker could execute
arbitrary commands with user privileges. (CVE-2006-7236, CVE-2008-2382)
Instructions: After a standard system upgrade you need to restart any running xterms to
effect the necessary changes.
Debian
CVE-2006-7236: xterm - The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu e...
vendor_debian·2006·CVSS 9.3
CVE-2006-7236 [CRITICAL] CVE-2006-7236: xterm - The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu e...
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Scope: local
bookworm: resolved (fixed in 238-1)
bullseye: resolved (fixed in 238-1)
forky: resolved (fixed in 238-1)
sid: resolved (fixed in 238-1)
trixie: resolved (fixed in 238-1)
Red Hat
CVE-2006-7236: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
vendor_redhat·CVSS 9.3
CVE-2006-7236 [CRITICAL] CVE-2006-7236: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Statement: Not vulnerable. This issue did not affect the versions of the xterm package, as shipped with Red Hat Enterprise Linux 3, 4, and 5, and the version of the XFree86 (providing xterm) and hanterm-xf packages, as shipped with Red Hat Enterprise Linux 2.1.
GHSA
GHSA-9r87-p9p6-pqp9: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
ghsa_unreviewed·2022-05-01
CVE-2006-7236 [HIGH] GHSA-9r87-p9p6-pqp9: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
OSV
CVE-2006-7236: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
osv·2009-01-02·CVSS 9.3
CVE-2006-7236 [CRITICAL] CVE-2006-7236: The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attacke
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
No detection rules found.
No writeups or analysis indexed.
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030http://secunia.com/advisories/33388https://usn.ubuntu.com/703-1/http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030http://secunia.com/advisories/33388https://usn.ubuntu.com/703-1/
2009-01-02
Published