Secunia

A vulnerability has been discovered in xterm, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to xterm not properly processing the DECRQSS Device Control Request Status String escape sequence. This can be exploited to inject and execute arbitrary shell commands by e.g. tricking a user into displaying a malicious text file containing a specially crafted escape sequence via the "more" command in xterm.

This is related to:
SA8146

The vulnerability is confirmed in xterm patch #237. Other versions may also be affected.

Solution
Update to xterm patch #238.

Provided and/or discovered by
Reported by Paul Szabo in a Debian bug.

Changelog
Further details available in Customer Area

Original Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area