Description
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | rxvt-unicode | 9.26-bp154.2.3.1 | openSUSE-SU-2022:10222-1 |
| SUSE Package Hub 15 SP3 | rxvt-unicode | 9.26-bp154.2.3.1 | openSUSE-SU-2022:10222-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rxvt-unicode | 9.22-1.1 | openSUSE-SU-2024:10526-1 |
| openSUSE Leap 15.4 | rxvt-unicode | 9.26-bp154.2.3.1 | openSUSE-SU-2022:10222-1 |
| openSUSE Leap 15.3 | rxvt-unicode | 9.26-bp154.2.3.1 | openSUSE-SU-2022:10222-1 |
Advisories 2
- openSUSE-SU-2022:10222-1 Security update for rxvt-unicode SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10526-1 rxvt-unicode-9.22-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- SUSE-SR:2008:017 vendor-advisory
- http://article.gmane.org/gmane.comp.security.oss.general/122
- 30226 third-party-advisory
- 28512 vdb-entry
- 30229 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296
- 31687 third-party-advisory
- 30225 third-party-advisory
- 30227 third-party-advisory
- GLSA-200805-03 vendor-advisory
- 30224 third-party-advisory
- MDVSA-2008:161 vendor-advisory
- MDVSA-2008:221 vendor-advisory
- 29576 third-party-advisory