9.3 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
6.3 Medium
AI Score
Confidence
Low
0.012 Low
EPSS
Percentile
85.1%
Debian Security Advisory DSA-1694-1 [email protected]
http://www.debian.org/security/ Florian Weimer
January 02, 2009 http://www.debian.org/security/faq
Package : xterm
Vulnerability : design flaw
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2008-2383
Debian Bug : 510030
Paul Szabo discovered that xterm, a terminal emulator for the X Window
System, places arbitrary characters into the input buffer when
displaying certain crafted escape sequences (CVE-2008-2383).
As an additional precaution, this security update also disables font
changing, user-defined keys, and X property changes through escape
sequences.
For the stable distribution (etch), this problem has been fixed in
version 222-1etch3.
For the unstable distribution (sid), this problem will be fixed soon.
We recommend that you upgrade your xterm package.
Upgrade instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
Source archives:
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.dsc
Size/MD5 checksum: 1123 3bcc850fe7c9057e5d5d03617cc95195
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.diff.gz
Size/MD5 checksum: 61664 f1e11e4f4c85db1e2ffa67c5d132d2e6
http://security.debian.org/pool/updates/main/x/xterm/xterm_222.orig.tar.gz
Size/MD5 checksum: 802986 bb77882a33083632a9c6c9de004a54fb
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_alpha.deb
Size/MD5 checksum: 437394 2a16b16a6ed79a908987769b9b5a68d8
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_amd64.deb
Size/MD5 checksum: 416434 46ba9b4430c313464afeaa856d02f09a
arm architecture (ARM)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_arm.deb
Size/MD5 checksum: 412020 9119d878ffedf54c843ec84a98022a3d
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_hppa.deb
Size/MD5 checksum: 421890 9b3326921fbbd0ba014b3717b20c53fb
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_i386.deb
Size/MD5 checksum: 403908 f54263828a01af2af86f25c1fedc7aa6
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_ia64.deb
Size/MD5 checksum: 509374 052861cf2a23d7a414c038d510fc7f01
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mips.deb
Size/MD5 checksum: 428858 63615939a4de2f4e3ba0cc61adbf0e47
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mipsel.deb
Size/MD5 checksum: 425604 9d18da53eea366eb2688dfe629d95e82
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_powerpc.deb
Size/MD5 checksum: 409986 824e743d4a6a1abeb5c1fdc0a9e7d006
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_s390.deb
Size/MD5 checksum: 422196 9b78491ef8fb34da8d5e183e91fc6c65
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_sparc.deb
Size/MD5 checksum: 409994 e284b9163d0da06f932f8e243ccaee2b
These files will probably be moved into the stable distribution on
its next update.
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 4 | sparc | xterm | < 222-1etch3 | xterm_222-1etch3_sparc.deb |
Debian | 4 | arm | xterm | < 222-1etch3 | xterm_222-1etch3_arm.deb |
Debian | 4 | mipsel | xterm | < 222-1etch3 | xterm_222-1etch3_mipsel.deb |
Debian | 4 | powerpc | xterm | < 222-1etch3 | xterm_222-1etch3_powerpc.deb |
Debian | 4 | amd64 | xterm | < 222-1etch3 | xterm_222-1etch3_amd64.deb |
Debian | 4 | all | xterm | < 222-1etch3 | xterm_222-1etch3_all.deb |
Debian | 4 | mips | xterm | < 222-1etch3 | xterm_222-1etch3_mips.deb |
Debian | 4 | s390 | xterm | < 222-1etch3 | xterm_222-1etch3_s390.deb |
Debian | 4 | alpha | xterm | < 222-1etch3 | xterm_222-1etch3_alpha.deb |
Debian | 4 | ia64 | xterm | < 222-1etch3 | xterm_222-1etch3_ia64.deb |