Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 884787 (CVE-2022-4170) - <x11-terms/rxvt-unicode-9.30: arbitrary code execution
Summary: <x11-terms/rxvt-unicode-9.30: arbitrary code execution
Alias: CVE-2022-4170
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major (vote)
Assignee: Gentoo Security
Whiteboard: A2 [glsa?]
Depends on:
Reported: 2022-12-08 00:16 UTC by John Helmert III
Modified: 2022-12-08 00:16 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-12-08 00:16:38 UTC
"I've discovered rxvt-unicode 9.25 and 9.26 are vulnerable to remote
code execution, in the Perl background extension, when an attacker can
control the data written to the user's terminal and certain options
are set.

The "background" extension is automatically loaded if certain X
resources are set such as 'transparent' (see the full list at the top
of src/perl/background[1]). So it is possible to be using this
extension without realising it.

This is accidentally fixed on version 9.30, and I haven't confirmed
9.29, it appears to not be exploitable, but only due to another (not
security) bug. The actual bug which makes this not vulnerable on 9.30
is simply a wrong number in "on_osc_seq"."

So, needs GLSA.