critique
CVE-2022-45063
xterm: code execution via OSC 50 input sequences
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Le label propre à Trivy est CRITICAL. Critique selon NVD, CBL-Mariner. Plus basse selon Red Hat (moyenne), AlmaLinux (faible), Oracle (faible), Rocky Linux (faible).
Description
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| CBL-Mariner 2.0 | xterm | 0:380-1.cm2 |
| alma 9 | xterm, xterm-resize | 366-10.el9_6 |
| debian 10 | xterm | pas de correctif indiqué |
| debian 11 | xterm | pas de correctif indiqué |
| debian 12 | xterm | 375-1 |
| debian 13 | xterm | 375-1 |
| debian 14 | xterm | 375-1 |
| echo | xterm | 375-1 |
| Oracle Linux 9 | xterm, xterm-resize | 366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm, xterm-resize | 0:366-10.el9_6 |
| rapidfort ubuntu 20.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 22.04 | xterm | 0:375-1ubuntu1 |
Afficher les 20 entrées de 15 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| CBL-Mariner 2.0 | xterm | 0:380-1.cm2 |
| alma 9 | xterm | 366-10.el9_6 |
| alma 9 | xterm-resize | 366-10.el9_6 |
| debian 10 | xterm | pas de correctif indiqué |
| debian 11 | xterm | pas de correctif indiqué |
| debian 12 | xterm | 375-1 |
| debian 13 | xterm | 375-1 |
| debian 14 | xterm | 375-1 |
| echo | xterm | 375-1 |
| Oracle Linux 9 | xterm | 366-10.el9_6 |
| Oracle Linux 9 | xterm-resize | 366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm | 0:366-10.el9_6 |
| rapidfort Oracle Linux 9 | xterm-resize | 0:366-10.el9_6 |
| rapidfort ubuntu 20.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 22.04 | xterm | 0:375-1ubuntu1 |
| rapidfort ubuntu 24.04 | xterm | 0:375-1ubuntu1 |
| Red Hat | xterm | pas de correctif indiqué |
| Red Hat | xterm-resize | pas de correctif indiqué |
| rocky 9 | xterm | 366-10.el9_6 |
| rocky 9 | xterm-resize | 366-10.el9_6 |
Références
- http://www.openwall.com/lists/oss-security/2022/11/10/1
- http://www.openwall.com/lists/oss-security/2022/11/10/5
- http://www.openwall.com/lists/oss-security/2024/06/15/1
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- http://www.openwall.com/lists/oss-security/2026/04/08/1
- http://www.openwall.com/lists/oss-security/2026/04/08/10
- https://access.redhat.com/errata/RHSA-2025:7427
- https://access.redhat.com/security/cve/CVE-2022-45063
Les 25 références
- https://bugzilla.redhat.com/2142474
- https://bugzilla.redhat.com/show_bug.cgi?id=2142474
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45063
- https://errata.almalinux.org/9/ALSA-2025-7427.html
- https://errata.rockylinux.org/RLSA-2025:7427
- https://invisible-island.net/xterm/xterm.log.html
- https://linux.oracle.com/cve/CVE-2022-45063.html
- https://linux.oracle.com/errata/ELSA-2025-7427.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5T2JI5JCHPTXX2KJU45H2XAHQSFVEJ2Y/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC/
- https://news.ycombinator.com/item?id=33546415
- https://nvd.nist.gov/vuln/detail/CVE-2022-45063
- https://security.gentoo.org/glsa/202211-09
- https://www.cve.org/CVERecord?id=CVE-2022-45063
- https://www.openwall.com/lists/oss-security/2022/11/10/1