Vulnerability · Published Nov 10, 2022 · Assigned by mitre
CVE-2022-45063
Critical 9.8
In plain English
A critical-severity security flaw in the xterm package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.4% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)5.4%top 7.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | xterm | 366-10.el9_6 | ALSA-2025:7427 |
| AlmaLinux:9 | xterm-resize | 366-10.el9_6 | ALSA-2025:7427 |
| Debian:12 | xterm | 375-1 | DEBIAN-CVE-2022-45063 |
| Debian:13 | xterm | 375-1 | DEBIAN-CVE-2022-45063 |
| Debian:14 | xterm | 375-1 | DEBIAN-CVE-2022-45063 |
| Rocky Linux:9 | xterm | 0:366-10.el9_6 | RLSA-2025:7427 |
| Ubuntu:22.04:LTS | xterm | no fix listed | UBUNTU-CVE-2022-45063 |
Affected products (as reported)
References
- https://invisible-island.net/xterm/xterm.log.html
- https://www.openwall.com/lists/oss-security/2022/11/10/1
- https://news.ycombinator.com/item?id=33546415
- [oss-security] 20221110 CVE-2022-45063: xterm <375 code execution via font ops mailing-list
- [oss-security] 20221110 Re: CVE-2022-45063: xterm <375 code execution via font ops mailing-list
- FEDORA-2022-681bbe67b6 vendor-advisory
- GLSA-202211-09 vendor-advisory
- FEDORA-2022-8cf76a9ceb vendor-advisory
- FEDORA-2022-af5f1eee2c vendor-advisory
- [oss-security] 20240615 iTerm2 3.5.x title reporting bug mailing-list
- [oss-security] 20240617 Re: iTerm2 3.5.x title reporting bug mailing-list
- http://www.openwall.com/lists/oss-security/2026/04/08/1
- http://www.openwall.com/lists/oss-security/2026/04/08/10