1. Forum
  2. Usenet
  3. LINUX.GENTOO.ANNOUNCE

  • [gentoo-announce] [ GLSA 202310-20 ] rxvt-unicode: Arbitrary Code Execu

    From glsamaker@gentoo.org@21:1/5 to All on Mon Oct 30 11:30:01 2023
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 202310-20
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    https://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Severity: High
    Title: rxvt-unicode: Arbitrary Code Execution
    Date: October 30, 2023
    Bugs: #884787
    ID: 202310-20

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    A vulnerability has been discovered in rxvt-unicode where data written
    to the terminal can lead to code execution.

    Background
    ==========

    rxvt-unicode is a clone of the well known terminal emulator rxvt.

    Affected packages
    =================

    Package Vulnerable Unaffected
    ---------------------- ------------ ------------
    x11-terms/rxvt-unicode < 9.30 >= 9.30

    Description
    ===========

    A vulnerability has been discovered in rxvt-unicode. Please review the
    CVE identifiers referenced below for details.

    Impact
    ======

    in the Perl background extension, when an attacker can
    control the data written to the user's terminal and certain options are
    set.

    The "background" extension is automatically loaded if certain X
    resources are set such as 'transparent' (see the full list at the top of src/perl/background[1]). So it is possible to be using this extension
    without realising it.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All rxvt-unicode users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=x11-terms/rxvt-unicode-9.30"

    References
    ==========

    [ 1 ] CVE-2022-4170
    https://nvd.nist.gov/vuln/detail/CVE-2022-4170

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

    https://security.gentoo.org/glsa/202310-20

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users' machines is of utmost
    importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

    License
    =======

    Copyright 2023 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    https://creativecommons.org/licenses/by-sa/2.5
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmU/g4QACgkQFMQkOaVy +9kDrRAAn97r3CXCfeuxwHduzf64nBAEc8OWkfCD6O+RTvmLpiPanYgohFcEn1Fp cbjcwSD/cP9NlqbcgAdFN2nElpFLKVfJlyjq8893n54u32aoL35MEqKmvQZ31x1C QhTln64wCX09k92+VUtlESUYJdyUFtE98Uaev7EEB22dot4qjCyZe57AWVNmvcLR ULhvtZE2r/YYCZ1nn42mPDv618JuKF+6goIwnCm+OI6vH6I9IJNGtR3cV8YiR6uT T0eLJrMgBiIetmYpazdEeGb3TTnNtD6Qgs6tw3AEq6dThlGRpUgdEeWe32F2y861 /uxo+LMBBSd1HwAKFh4L9hWJw/5j467O0J4pBj2TcxEUxBtZDlFMQ+S4yAVu8bVD pR6YLMAU89LvzOUzTaLBZzpRVHmxAFGyd50fjxnYEfd06BMXdBMiaCoEQjBZJhJj DdLc3X6Zmus2tiovY1ESwJRhYKUCM9eO/ndzR5MO2TvO+VKW+O/EzgNSqrv97KzD Z58G+0ykepZ9GX/IC3gLAd2ZdG/OJqic89zQpYyQ6jih1KC3CU/D2JPOq3JPShzP GlzZFsRl7p+3S8XoIrKTn8y1zTxieSFIOpe/sIjpzQhrPBmniriAQiIpYZSUmoPV uSVuoU3c7Py1rcAptmN6YpJZCnFpsqgK/H/SmRSv2aCG13eDrkE=
    =Yq/C
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)