Description
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xterm | 366-1 | — |
| Debian 13 | xterm | 366-1 | — |
| Debian 12 | xterm | 366-1 | — |
| Debian 9 | xterm | 327-2+deb9u1 | DLA-2558-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | xterm | 353-1ubuntu1.20.04.2 | USN-4746-1 |
| Ubuntu 18.04 LTS | xterm | 330-1ubuntu2.2 | USN-4746-1 |
| Ubuntu 16.04 LTS | xterm | 322-1ubuntu1.2 | USN-4746-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | xterm +1 | 331-1.el8_3.2 | RHSA-2021:0611 |
| RHEL 7 | xterm | 295-3.el7_9.1 | RHSA-2021:0617 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.2 EUS | xterm +1 | 331-1.el8_2.1 | RHSA-2021:0651 |
| RHEL 8.1 EUS | xterm +1 | 331-1.el8_1.1 | RHSA-2021:0650 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | xterm +1 | 331-1.el8_3.2 | ALSA-2021:0611 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | xterm | 331-1.el8_3.2 | RLSA-2021:0611 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | xterm | 330-11.3.1 | SUSE-SU-2021:2011-1 |
| SLES 15 SP2 | xterm | 330-11.3.1 | SUSE-SU-2021:2011-1 |
| SLES 15 SP1 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SLES 15 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SLES 12 SP5 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
Show 21 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLES 12 SP3 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLES 12 SP2 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLES 11 SP4 | xterm | 238-3.3.1 | SUSE-SU-2021:14747-1 |
| SLES for SAP 15 SP1 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SLES for SAP 15 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SLES for SAP 12 SP5 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLES for SAP 12 SP4 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLES for SAP 12 SP3 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SLE HPC 15 SP1 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SLE HPC 15 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SUSE OpenStack Cloud Crowbar 9 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SUSE OpenStack Cloud Crowbar 8 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SUSE OpenStack Cloud 9 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SUSE OpenStack Cloud 8 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SUSE Manager Server 4.0 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SUSE Manager Retail Branch Server 4.0 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SUSE Manager Proxy 4.0 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | xterm | 238-3.3.1 | SUSE-SU-2021:14747-1 |
| SUSE HPE Helion OpenStack 8 | xterm | 308-5.3.1 | SUSE-SU-2021:2014-1 |
| SUSE Enterprise Storage 6 | xterm | 330-4.3.1 | SUSE-SU-2021:2013-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xterm | 368-2.2 | openSUSE-SU-2024:11527-1 |
| openSUSE Leap 15.3 | xterm | 330-11.3.1 | openSUSE-SU-2021:2011-1 |
| openSUSE Leap 15.2 | xterm | 330-lp152.6.3.1 | openSUSE-SU-2021:0900-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | xterm | 366-r0 | — |
| Alpine v3.23 | xterm | 366-r0 | — |
| Alpine v3.22 | xterm | 366-r0 | — |
| Alpine v3.21 | xterm | 366-r0 | — |
| Alpine v3.20 | xterm | 366-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | xterm | 366-r0 | — |
| Alpine v3.18 | xterm | 366-r0 | — |
| Alpine v3.17 | xterm | 366-r0 | — |
| Alpine v3.16 | xterm | 366-r0 | — |
| Alpine v3.15 | xterm | 366-r0 | — |
| Alpine v3.14 | xterm | 366-r0 | — |
| Alpine v3.13 | xterm | 367-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | xterm | 295-3.amzn2.1 | ALAS2-2021-1619 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | xterm | 372-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | xterm +1 | 331-1.el8_3.2 | ELSA-2021-0611 |
| Oracle Linux 7 | xterm | 295-3.el7_9.1 | ELSA-2021-0617 |
Advisories 18
- ALSA-2021:0611 Important: xterm security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2021:0617 Red Hat Security Advisory: xterm security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-2558-1 xterm - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4746-1 xterm vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2021:0611 Important: xterm security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2021:2013-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2014-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:2011-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2011-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:14747-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0900-1 Security update for xterm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11527-1 xterm-368-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2021:0650 Red Hat Security Advisory: xterm security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:0651 Red Hat Security Advisory: xterm security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2021:0611 Red Hat Security Advisory: xterm security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2021-1619 Important: xterm security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Mar 19, 2021
- ELSA-2021-0617 Important: xterm security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 23, 2021
- ELSA-2021-0611 Important: xterm security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 18, 2021
References
- https://www.openwall.com/lists/oss-security/2021/02/09/7
- https://www.openwall.com/lists/oss-security/2021/02/09/9
- [oss-security] 20210210 Re: Re: screen crash processing combining characters mailing-list
- [debian-lts-announce] 20210213 [SECURITY] [DLA 2558-1] xterm security update mailing-list
- FEDORA-2021-e7a8e79fa8 vendor-advisory
- https://news.ycombinator.com/item?id=26524650
- https://access.redhat.com/security/cve/CVE-2021-27135
- https://bugzilla.redhat.com/show_bug.cgi?id=1927559
- https://invisible-island.net/xterm/xterm.log.html
- https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c
- https://bugzilla.suse.com/show_bug.cgi?id=1182091
- 20210520 CVE-2021-31535 libX11 Insufficient Length Checks PoC and Archeology mailing-list
- GLSA-202208-22 vendor-advisory