Vulnerability · Published Feb 10, 2021 · Assigned by mitre
CVE-2021-27135
Critical 9.8
In plain English
A critical-severity security flaw in the xterm package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.2% (higher than 95% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)8.2%top 5.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | xterm | 331-1.el8_3.2 | ALSA-2021:0611 |
| AlmaLinux:8 | xterm-resize | 331-1.el8_3.2 | ALSA-2021:0611 |
| Alpine:v3.20 | xterm | 366-r0 | ALPINE-CVE-2021-27135 |
| Alpine:v3.21 | xterm | 366-r0 | ALPINE-CVE-2021-27135 |
| Alpine:v3.22 | xterm | 366-r0 | ALPINE-CVE-2021-27135 |
| Alpine:v3.23 | xterm | 366-r0 | ALPINE-CVE-2021-27135 |
| Alpine:v3.24 | xterm | 366-r0 | ALPINE-CVE-2021-27135 |
| Debian:12 | xterm | 366-1 | DEBIAN-CVE-2021-27135 |
| Debian:13 | xterm | 366-1 | DEBIAN-CVE-2021-27135 |
| Debian:14 | xterm | 366-1 | DEBIAN-CVE-2021-27135 |
| Rocky Linux:8 | xterm | 0:331-1.el8_3.2 | RLSA-2021:0611 |
Affected products (as reported)
References
- https://www.openwall.com/lists/oss-security/2021/02/09/7 x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2021/02/09/9 x_refsource_MISC
- [oss-security] 20210210 Re: Re: screen crash processing combining characters mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210213 [SECURITY] [DLA 2558-1] xterm security update mailing-list, x_refsource_MLIST
- FEDORA-2021-e7a8e79fa8 vendor-advisory, x_refsource_FEDORA
- https://news.ycombinator.com/item?id=26524650 x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2021-27135 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=1927559 x_refsource_MISC
- https://invisible-island.net/xterm/xterm.log.html x_refsource_CONFIRM
- https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c x_refsource_CONFIRM
- https://bugzilla.suse.com/show_bug.cgi?id=1182091 x_refsource_CONFIRM
- 20210520 CVE-2021-31535 libX11 Insufficient Length Checks PoC and Archeology mailing-list, x_refsource_FULLDISC
- GLSA-202208-22 vendor-advisory, x_refsource_GENTOO