Critical Security Update for xterm: Code Execution Vulnerability
Summary
ALSA-2025:7427: Low: xterm security update. Affects xterm versions < 366-10.el9_6. Fixed in 366-10.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
xterm is a terminal emulator for the X Window System, providing DEC VT102 and Tektronix 4014 compatible terminals for applications that cannot directly utilize the window system. It is widely used in various Linux distributions, including AlmaLinux. The recent vulnerability identified poses a significant risk, allowing potential code execution through specific input sequences.
Vulnerability Detail
The vulnerability, identified as CVE-2022-45063, allows for code execution via OSC 50 input sequences in the xterm program. This issue arises from improper handling of input sequences, which could enable an attacker to execute arbitrary code on the affected system. The ramifications of this vulnerability can be severe, potentially leading to unauthorized access and control over the system running the vulnerable xterm version.
How To Fix
Minimum fixed version
366-10.el9_6
This is the first release that contains the fix.
sudo dnf update xtermTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the xterm terminal emulator until the package is updated to the patched version. Additionally, restricting the input sequences that can be processed by xterm may help reduce exposure to this vulnerability.
Conclusion
The xterm security vulnerability, CVE-2022-45063, poses a significant risk by allowing code execution through specific input sequences. Users are strongly advised to update their xterm package to the latest version to mitigate this risk. For real-time monitoring of vulnerabilities, consider using Vulert, which can help identify if your application is affected.
See every vulnerability recorded for xterm →
FAQ
CVE-2022-45063 is a vulnerability in the xterm terminal emulator that allows for code execution through OSC 50 input sequences.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include potential unauthorized access and control over the system, which could lead to data breaches or system compromise.
Yes, a patch is available. Users should update to version 366-10.el9_6 or later to fix the vulnerability.
If immediate updates are not possible, consider using alternative terminal emulators or restricting the input sequences processed by xterm as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for xterm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
