rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
References
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2008-04-07 17:44
Updated : 2024-02-04 17:33
NVD link : CVE-2008-1142
Mitre link : CVE-2008-1142
CVE.ORG link : CVE-2008-1142
JSON object : View
Products Affected
wterm
- wterm
rxvt
- rxvt
rxvt-unicode
- rxvt-unicode
aterm
- aterm
eterm
- eterm
mrxvt
- mrxvt
multi-aterm
- multi-aterm
CWE
CWE-264
Permissions, Privileges, and Access Controls