"A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute arbitrary shell commands by e.g. tricking a user into displaying a malicious text file containing a specially crafted escape sequence via the "more" command in xterm."
There is a thread in debian ml (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030) that contains a fix:
Xterm 238 released:
We need a version bump here to fix the bug.
239 is in the tree.
Arches, please test and mark stable:
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Stable for HPPA.
GLSA request filed.