kritisch
CVE-2022-45063
xterm: code execution via OSC 50 input sequences
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, CBL-Mariner. Niedriger laut Red Hat (mittel), AlmaLinux (niedrig), Oracle (niedrig), Rocky Linux (niedrig).
Beschreibung
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 2.0 | xterm | 0:380-1.cm2 |
| alma 9 | xterm, xterm-resize | 366-10.el9_6 |
| debian 10 | xterm | kein Fix angegeben |
| debian 11 | xterm | kein Fix angegeben |
| debian 12 | xterm | 375-1 |
| debian 13 | xterm | 375-1 |
| debian 14 | xterm | 375-1 |
| echo | xterm | 375-1 |
| Oracle Linux 9 | xterm, xterm-resize | 366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm, xterm-resize | 0:366-10.el9_6 |
| rapidfort ubuntu 20.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 22.04 | xterm | 0:375-1ubuntu1 |
Alle 20 Einträge aus 15 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| CBL-Mariner 2.0 | xterm | 0:380-1.cm2 |
| alma 9 | xterm | 366-10.el9_6 |
| alma 9 | xterm-resize | 366-10.el9_6 |
| debian 10 | xterm | kein Fix angegeben |
| debian 11 | xterm | kein Fix angegeben |
| debian 12 | xterm | 375-1 |
| debian 13 | xterm | 375-1 |
| debian 14 | xterm | 375-1 |
| echo | xterm | 375-1 |
| Oracle Linux 9 | xterm | 366-10.el9_6 |
| Oracle Linux 9 | xterm-resize | 366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm | 0:366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm-resize | 0:366-10.el9_6 |
| rapidfort ubuntu 20.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 22.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 24.04 | xterm | 0:375-1ubuntu1 |
| Red Hat | xterm | kein Fix angegeben |
| Red Hat | xterm-resize | kein Fix angegeben |
| rocky 9 | xterm | 366-10.el9_6 |
| rocky 9 | xterm-resize | 366-10.el9_6 |
Referenzen
- http://www.openwall.com/lists/oss-security/2022/11/10/1
- http://www.openwall.com/lists/oss-security/2022/11/10/5
- http://www.openwall.com/lists/oss-security/2024/06/15/1
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- http://www.openwall.com/lists/oss-security/2026/04/08/1
- http://www.openwall.com/lists/oss-security/2026/04/08/10
- https://access.redhat.com/errata/RHSA-2025:7427
- https://access.redhat.com/security/cve/CVE-2022-45063
Alle 25 Referenzen
- https://bugzilla.redhat.com/2142474
- https://bugzilla.redhat.com/show_bug.cgi?id=2142474
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45063
- https://errata.almalinux.org/9/ALSA-2025-7427.html
- https://errata.rockylinux.org/RLSA-2025:7427
- https://invisible-island.net/xterm/xterm.log.html
- https://linux.oracle.com/cve/CVE-2022-45063.html
- https://linux.oracle.com/errata/ELSA-2025-7427.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5T2JI5JCHPTXX2KJU45H2XAHQSFVEJ2Y/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC/
- https://news.ycombinator.com/item?id=33546415
- https://nvd.nist.gov/vuln/detail/CVE-2022-45063
- https://security.gentoo.org/glsa/202211-09
- https://www.cve.org/CVERecord?id=CVE-2022-45063
- https://www.openwall.com/lists/oss-security/2022/11/10/1