[ GLSA 202105-17 ] rxvt-unicode

[GLSA]

Gentoo Linux Security Advisory

Title: rxvt-unicode: User-assisted execution of arbitrary code (GLSA 202105-17)
Severity: normal
Exploitable: local, remote
Date: 2021-05-26
Bug(s): #790782
ID: 202105-17

Synopsis

A vulnerability in rxvt-unicode may allow a remote attacker to
execute arbitrary code.


Background

rxvt-unicode (urxvt) is a clone of the rxvt terminal emulator.

Affected Packages

Package: x11-terms/rxvt-unicode
Vulnerable: < 9.22-r9
Unaffected: >= 9.22-r9
Architectures: All supported architectures


Description

It was discovered that rxvt-unicode did not properly handle certain
escape sequences.


Impact

A remote attacker could entice a user to run a program where attacker
controls the output inside a rxvt terminal window, possibly resulting in
execution of arbitrary code with the privileges of the process or a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All rxvt-unicode users should upgrade to the latest version: