Unscored severity · published Apr 7, 2008
CVE-2008-1142
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections
–
CVSS
0.4%
EPSS
No
On KEV
Description
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Aterm · Aterm
through 1.0.0; 0.1.0; 0.1.1; 0.2.0; 0.3.0; 0.3.1; +12 more · source: NVD
ET
Eterm · Eterm
through 0.9.3; 0.9.2 · source: NVD
MR
Mrxvt · Mrxvt
through 0.5.2; 0.4.2 · source: NVD
MU
Multi-aterm · Multi-aterm
through 0.2; 0.0.1; 0.0.3; 0.0.4; 0.0.5; 0.1 · source: NVD
RX
Rxvt · Rxvt
through 2.7.9; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.7.5; +3 more · source: NVD
RX
Rxvt-unicode · Rxvt-unicode
through 9.01; 1.0; 1.1; 1.2; 1.3; 1.4; +34 more · source: NVD
WT
Wterm · Wterm
through 6.2.8a2; 6.2.5; 6.2.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1142
article.gmane.org
http://article.gmane.org/gmane.comp.security.oss.general/122
Vendor Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
Vendor Advisory
http://secunia.com/advisories/29576
Vendor Advisory
http://secunia.com/advisories/30224
Vendor Advisory
http://secunia.com/advisories/30225
More from Aterm
–
CVE-2003-0067
The aterm terminal emulator 0.42 allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's…
–
CVE-2003-0024
The menuBar feature in aterm 0.42 allows attackers to modify menu options and execute arbitrary commands via a certain character escape sequence that inserts the commands into the…