CVE-2021-27135

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining…

published February 10, 2021

CVSS
—
EPSS
8%
Percentile
94.7
In the wild
Unconfirmed
What it is

⚠️ A crafty sequence of UTF-8 combining characters is all it takes for an attacker to launch an attack in xterm before Patch #366! Think of it as a waiter who misreads a complex order — instead of serving the right dish, they create a chaotic mess that shuts down the kitchen! 🍽️ An attacker could exploit this to execute arbitrary code or crash the entire terminal application, leading to a frustrating denial of service. While no known exploits are currently active, the potential for chaos is definitely there! 🚨

Put simply

Think of it as a waiter who misreads a complex order — instead of serving the right dish, they create a chaotic mess that shuts down the kitchen! 🍽️ This vulnerability in xterm allows remote attackers to send specially crafted UTF-8 sequences that could either crash the terminal or execute commands, making it a versatile vector for tricky attacks.

What to do

An attacker could exploit this to execute arbitrary code or crash the entire terminal application, leading to a frustrating denial of service. While no known exploits are currently active, the potential for chaos is definitely there! 🚨 Upgrade xterm to the latest version where this patch is applied, specifically after Patch #366, to safeguard your systems. Regularly check for updates to ensure you're not running vulnerable software! You've got this! Stay vigilant and keep your systems updated for a smooth, secure experience. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.07844 · 94.7th percentile
Published
2021-02-10T15:51Z
EPSS history
Timeline
  • 10 FEB 15:51Z
    xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining…
    cvelistv5