CVE-2021-33477

published 2021-05-20

CVE-2021-33477: rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences…

Priority P3 57 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	eterm	< eterm 0.9.6-6.1 (bookworm)	eterm 0.9.6-6.1 (bookworm)
debian	rxvt-unicode	< eterm 0.9.6-6.1 (bookworm)	eterm 0.9.6-6.1 (bookworm)
eterm	eterm	>= 0 < 0.9.6-6.1	0.9.6-6.1
eterm	eterm	>= 0 < 0.9.6-6.1	0.9.6-6.1
eterm	eterm	>= 0 < 0.9.6-6.1	0.9.6-6.1
eterm_project	eterm	—	—
fedoraproject	fedora	—	—
fedoraproject	fedora	—	—
mrxvt_project	mrxvt	—	—
rxvt-unicode_project	rxvt-unicode	—	—
rxvt-unicode_project	rxvt-unicode	>= 0 < 9.22-11	9.22-11
rxvt-unicode_project	rxvt-unicode	>= 0 < 9.22-11	9.22-11
rxvt-unicode_project	rxvt-unicode	>= 0 < 9.22-11	9.22-11
rxvt-unicode_project	rxvt-unicode	>= 0 < 9.22-11	9.22-11
rxvt_project	rxvt	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

osv 8.8 HIGH

vendor_debian 8.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-755