Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 884787 (CVE-2022-4170)

Summary: <x11-terms/rxvt-unicode-9.30: arbitrary code execution
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: major CC: marecki
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A2 [glsa+]
Package list:
Runtime testing required: ---

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-12-08 00:16:38 UTC
"I've discovered rxvt-unicode 9.25 and 9.26 are vulnerable to remote
code execution, in the Perl background extension, when an attacker can
control the data written to the user's terminal and certain options
are set.

The "background" extension is automatically loaded if certain X
resources are set such as 'transparent' (see the full list at the top
of src/perl/background[1]). So it is possible to be using this
extension without realising it.

This is accidentally fixed on version 9.30, and I haven't confirmed
9.29, it appears to not be exploitable, but only due to another (not
security) bug. The actual bug which makes this not vulnerable on 9.30
is simply a wrong number in "on_osc_seq"."

So, needs GLSA.
Comment 1 Larry the Git Cow gentoo-dev 2023-10-30 10:20:16 UTC
The bug has been referenced in the following commit(s):

commit d12a82540d0c09c7cbfd5cec49458e7628226b4b
Author:     GLSAMaker <>
AuthorDate: 2023-10-30 10:19:42 +0000
Commit:     Hans de Graaff <>
CommitDate: 2023-10-30 10:20:09 +0000

    [ GLSA 202310-20 ] rxvt-unicode: Arbitrary Code Execution
    Signed-off-by: GLSAMaker <>
    Signed-off-by: Hans de Graaff <>

 glsa-202310-20.xml | 45 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)