Moderate Security Vulnerability in xterm Package: Buffer Overflow Risk
Summary
RLSA-2025:14075: Moderate: xterm security update. Affects xterm versions < 0:366-12.el9_6. Fixed in 0:366-12.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xterm program is a terminal emulator for the X Window System, providing DEC VT102 and Tektronix 4014 compatible terminals for applications that cannot directly utilize the window system. It is widely used in various Linux distributions, including Rocky Linux, for its robust functionality in terminal emulation. However, it has been identified to have a security vulnerability that could potentially lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2022-24130, is a buffer overflow in the set_sixel function located in graphics_sixel.c. This flaw allows an attacker to exploit the xterm terminal emulator, potentially leading to arbitrary code execution. The impact of this vulnerability is significant, as it could allow unauthorized access to system resources, data leakage, or even complete system compromise. The CVSS score for this vulnerability is 5.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
0:366-12.el9_6
This is the first release that contains the fix.
sudo dnf update xtermTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of the xterm terminal emulator until the package is updated. Alternatively, consider using other terminal emulators that do not exhibit this vulnerability.
Conclusion
The xterm package has a moderate security vulnerability that could lead to significant risks if left unaddressed. Users are encouraged to update their packages promptly to mitigate these risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for xterm →
FAQ
The vulnerability is a buffer overflow in the set_sixel function, which can lead to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, data leakage, or complete system compromise.
Yes, a patched version of the xterm package is available. Updating to the latest version will resolve the issue.
As a temporary measure, consider using alternative terminal emulators or limit the use of xterm until it is updated.
Related vulnerabilities
Recent vulnerabilities recorded for xterm.
