Description
The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence. NOTE: this issue exists because of a CVE-2003-0070 regression.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | vte | 1:0.24.3-1 | — |
| Debian 13 | vte | 1:0.24.3-1 | — |
| Debian 12 | vte | 1:0.24.3-1 | — |
References
- USN-962-1 vendor-advisory
- ADV-2010-1839 vdb-entry
- 41716 vdb-entry
- SUSE-SR:2010:014 vendor-advisory
- http://git.gnome.org/browse/vte/commit/?id=8b971a7b2c59902914ecbbc3915c45dd21530a91
- https://bugzilla.redhat.com/show_bug.cgi?id=613110
- 40635 third-party-advisory