Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2003-0063 (GCVE-0-2003-0063)
Vulnerability from cvelistv5 – Published: 2004-09-01 04:00 – Updated: 2024-10-29 14:05
VLAI?
EPSS
Summary
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Severity ?
7.3 (High)
CWE
- n/a
Assigner
References
| URL | Tags | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:43:35.241Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-380",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"name": "RHSA-2003:067",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"name": "RHSA-2003:066",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"name": "RHSA-2003:064",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"name": "RHSA-2003:065",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"name": "6940",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/6940"
},
{
"name": "terminal-emulator-window-title(11414)",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"name": "[oss-security] 20240615 iTerm2 3.5.x title reporting bug",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/06/15/1"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:xfree86:xfree86:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "xfree86",
"vendor": "xfree86",
"versions": [
{
"lessThanOrEqual": "4.2.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2003-0063",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-24T17:38:21.119752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T14:05:49.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-02-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-15T10:05:53.568606",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-380",
"tags": [
"vendor-advisory"
],
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"name": "RHSA-2003:067",
"tags": [
"vendor-advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"name": "RHSA-2003:066",
"tags": [
"vendor-advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"tags": [
"mailing-list"
],
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"name": "RHSA-2003:064",
"tags": [
"vendor-advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"name": "RHSA-2003:065",
"tags": [
"vendor-advisory"
],
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"name": "6940",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/6940"
},
{
"name": "terminal-emulator-window-title(11414)",
"tags": [
"vdb-entry"
],
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"tags": [
"mailing-list"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"name": "[oss-security] 20240615 iTerm2 3.5.x title reporting bug",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/06/15/1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0063",
"datePublished": "2004-09-01T04:00:00",
"dateReserved": "2003-02-04T00:00:00",
"dateUpdated": "2024-10-29T14:05:49.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F33E5444-E178-4F49-BDA1-DE576D8526EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1BCC09AA-AB01-4583-8052-66DBF0E1861D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43425C85-806B-4823-AD74-D0A0465FC8DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"90FA67D9-8296-4534-8354-51B830DE3499\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4AC4F566-5D54-4364-B5AA-F846A0C8FCEB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F9D1BD9-4300-43B5-A87B-E2BF74E55C87\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.\"}, {\"lang\": \"es\", \"value\": \"El emulador de terminal xterm en XFree86 4.2.0 permite a atacantes modificar el t\\u00edtulo de la ventana mediante cierta secuencia de caracter de escape y a continuaci\\u00f3n insertarlo de vuelta en la linea de comando en el terminal del usuario, por ejemplo, cuando el usuario ve un fichero que contiene la secuencia maliciosa, lo que podr\\u00eda permitir ejecutar comandos arbitrarios.\"}]",
"id": "CVE-2003-0063",
"lastModified": "2024-11-20T23:43:51.587",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.4}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}",
"published": "2003-03-03T05:00:00.000",
"references": "[{\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2003-0063\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2003-03-03T05:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.\"},{\"lang\":\"es\",\"value\":\"El emulador de terminal xterm en XFree86 4.2.0 permite a atacantes modificar el t\u00edtulo de la ventana mediante cierta secuencia de caracter de escape y a continuaci\u00f3n insertarlo de vuelta en la linea de comando en el terminal del usuario, por ejemplo, cuando el usuario ve un fichero que contiene la secuencia maliciosa, lo que podr\u00eda permitir ejecutar comandos arbitrarios.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F33E5444-E178-4F49-BDA1-DE576D8526EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1BCC09AA-AB01-4583-8052-66DBF0E1861D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43425C85-806B-4823-AD74-D0A0465FC8DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90FA67D9-8296-4534-8354-51B830DE3499\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AC4F566-5D54-4364-B5AA-F846A0C8FCEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F9D1BD9-4300-43B5-A87B-E2BF74E55C87\"}]}]}],\"references\":[{\"url\":\"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2003/dsa-380\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.iss.net/security_center/static/11414.php\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/15/1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-064.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-065.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-066.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-067.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/6940\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.debian.org/security/2003/dsa-380\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.iss.net/security_center/static/11414.php\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/15/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-064.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-065.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-066.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2003-067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/6940\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"name\": \"DSA-380\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"name\": \"RHSA-2003:067\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"name\": \"RHSA-2003:066\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"name\": \"RHSA-2003:064\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"name\": \"RHSA-2003:065\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"name\": \"6940\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"name\": \"terminal-emulator-window-title(11414)\", \"tags\": [\"vdb-entry\", \"x_transferred\"]}, {\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"name\": \"[oss-security] 20240615 iTerm2 3.5.x title reporting bug\", \"tags\": [\"mailing-list\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-08T01:43:35.241Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2003-0063\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-24T17:38:21.119752Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:xfree86:xfree86:*:*:*:*:*:*:*:*\"], \"vendor\": \"xfree86\", \"product\": \"xfree86\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.2.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-24T17:39:25.055Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"datePublic\": \"2003-02-24T00:00:00\", \"references\": [{\"url\": \"http://www.debian.org/security/2003/dsa-380\", \"name\": \"DSA-380\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-067.html\", \"name\": \"RHSA-2003:067\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-066.html\", \"name\": \"RHSA-2003:066\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-064.html\", \"name\": \"RHSA-2003:064\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2003-065.html\", \"name\": \"RHSA-2003:065\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/6940\", \"name\": \"6940\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"http://www.iss.net/security_center/static/11414.php\", \"name\": \"terminal-emulator-window-title(11414)\", \"tags\": [\"vdb-entry\"]}, {\"url\": \"http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html\", \"name\": \"20030224 Terminal Emulator Security Issues\", \"tags\": [\"mailing-list\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/15/1\", \"name\": \"[oss-security] 20240615 iTerm2 3.5.x title reporting bug\", \"tags\": [\"mailing-list\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2024-06-15T10:05:53.568606\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2003-0063\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-29T14:05:49.769Z\", \"dateReserved\": \"2003-02-04T00:00:00\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2004-09-01T04:00:00\", \"assignerShortName\": \"mitre\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
RHSA-2003:064
Vulnerability from csaf_redhat - Published: 2003-06-25 15:51 - Updated: 2025-11-21 17:25Summary
Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available
Notes
Topic
Updated XFree86 packages that resolve various security issues and
additionally provide a number of bug fixes and enhancements are now
available for Red Hat Linux 7.1 and 7.2.
Details
XFree86 is an implementation of the X Window System, which provides the
graphical user interface, video drivers, etc. for Linux systems.
Since the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of
security vulnerabilities have been found and fixed. In addition, various
other bug fixes, driver updates, and other enhancements have been made.
Security fixes:
Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.
The xdm display manager, with the authComplain variable set to false,
allows arbitrary attackers to connect to the X server if the xdm auth
directory does not exist. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.
These erratum packages also contain an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to
this issue.
Driver updates and other fixes:
The Rage 128 video driver (r128) has been updated to provide 2D support
for all previously unsupported ATI Rage 128 hardware. DRI 3D support
should also work on the majority of Rage 128 hardware.
Bad page size assumptions in the ATI Radeon video driver (radeon) have
been fixed to allow the driver to work properly on ia64 and other
architectures where the page size is not fixed.
A long-standing XFree86 bug has been fixed. This bug occurs when any form
of system clock skew (such as NTP clock synchronization, APM suspend/resume
cycling on laptops, daylight savings time changeover, or even manually
setting the system clock forward or backward) could result in odd
application behavior, mouse and keyboard lockups, or even an X server hang
or crash.
The S3 Savage driver (savage) has been updated to the upstream author's
latest version "1.1.27t", which should fix numerous bugs reported by
various users, as well as adding support for some newer savage hardware.
Users are advised to upgrade to these updated packages, which are not
vulnerable to the previously-mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated XFree86 packages that resolve various security issues and\nadditionally provide a number of bug fixes and enhancements are now\navailable for Red Hat Linux 7.1 and 7.2.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System, which provides the\ngraphical user interface, video drivers, etc. for Linux systems.\n\nSince the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of\nsecurity vulnerabilities have been found and fixed. In addition, various\nother bug fixes, driver updates, and other enhancements have been made.\n\nSecurity fixes:\n\nXterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\nIt is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.\n\nThe xdm display manager, with the authComplain variable set to false,\nallows arbitrary attackers to connect to the X server if the xdm auth\ndirectory does not exist. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.\n\nThese erratum packages also contain an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\nThe X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to\nthis issue.\n\nDriver updates and other fixes:\n\nThe Rage 128 video driver (r128) has been updated to provide 2D support\nfor all previously unsupported ATI Rage 128 hardware. DRI 3D support\nshould also work on the majority of Rage 128 hardware.\n\nBad page size assumptions in the ATI Radeon video driver (radeon) have\nbeen fixed to allow the driver to work properly on ia64 and other\narchitectures where the page size is not fixed.\n\nA long-standing XFree86 bug has been fixed. This bug occurs when any form\nof system clock skew (such as NTP clock synchronization, APM suspend/resume\ncycling on laptops, daylight savings time changeover, or even manually\nsetting the system clock forward or backward) could result in odd\napplication behavior, mouse and keyboard lockups, or even an X server hang\nor crash.\n\nThe S3 Savage driver (savage) has been updated to the upstream author\u0027s\nlatest version \"1.1.27t\", which should fix numerous bugs reported by\nvarious users, as well as adding support for some newer savage hardware.\n\nUsers are advised to upgrade to these updated packages, which are not\nvulnerable to the previously-mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:064",
"url": "https://access.redhat.com/errata/RHSA-2003:064"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_064.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available",
"tracking": {
"current_release_date": "2025-11-21T17:25:38+00:00",
"generator": {
"date": "2025-11-21T17:25:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2003:064",
"initial_release_date": "2003-06-25T15:51:00+00:00",
"revision_history": [
{
"date": "2003-06-25T15:51:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:25:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 7.1",
"product": {
"name": "Red Hat Linux 7.1",
"product_id": "Red Hat Linux 7.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.1"
}
}
},
{
"category": "product_name",
"name": "Red Hat Linux 7.2",
"product": {
"name": "Red Hat Linux 7.2",
"product_id": "Red Hat Linux 7.2",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1510",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616920"
}
],
"notes": [
{
"category": "description",
"text": "xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1510"
},
{
"category": "external",
"summary": "RHBZ#1616920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1510",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1510"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510"
}
],
"release_date": "2001-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003_064
Vulnerability from csaf_redhat - Published: 2003-06-25 15:51 - Updated: 2024-11-21 22:39Summary
Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available
Notes
Topic
Updated XFree86 packages that resolve various security issues and
additionally provide a number of bug fixes and enhancements are now
available for Red Hat Linux 7.1 and 7.2.
Details
XFree86 is an implementation of the X Window System, which provides the
graphical user interface, video drivers, etc. for Linux systems.
Since the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of
security vulnerabilities have been found and fixed. In addition, various
other bug fixes, driver updates, and other enhancements have been made.
Security fixes:
Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.
The xdm display manager, with the authComplain variable set to false,
allows arbitrary attackers to connect to the X server if the xdm auth
directory does not exist. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.
These erratum packages also contain an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to
this issue.
Driver updates and other fixes:
The Rage 128 video driver (r128) has been updated to provide 2D support
for all previously unsupported ATI Rage 128 hardware. DRI 3D support
should also work on the majority of Rage 128 hardware.
Bad page size assumptions in the ATI Radeon video driver (radeon) have
been fixed to allow the driver to work properly on ia64 and other
architectures where the page size is not fixed.
A long-standing XFree86 bug has been fixed. This bug occurs when any form
of system clock skew (such as NTP clock synchronization, APM suspend/resume
cycling on laptops, daylight savings time changeover, or even manually
setting the system clock forward or backward) could result in odd
application behavior, mouse and keyboard lockups, or even an X server hang
or crash.
The S3 Savage driver (savage) has been updated to the upstream author's
latest version "1.1.27t", which should fix numerous bugs reported by
various users, as well as adding support for some newer savage hardware.
Users are advised to upgrade to these updated packages, which are not
vulnerable to the previously-mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated XFree86 packages that resolve various security issues and\nadditionally provide a number of bug fixes and enhancements are now\navailable for Red Hat Linux 7.1 and 7.2.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System, which provides the\ngraphical user interface, video drivers, etc. for Linux systems.\n\nSince the last XFree86 update for Red Hat Linux 7.1 and 7.2, a number of\nsecurity vulnerabilities have been found and fixed. In addition, various\nother bug fixes, driver updates, and other enhancements have been made.\n\nSecurity fixes:\n\nXterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\nIt is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.\n\nThe xdm display manager, with the authComplain variable set to false,\nallows arbitrary attackers to connect to the X server if the xdm auth\ndirectory does not exist. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.\n\nThese erratum packages also contain an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\nThe X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to\nthis issue.\n\nDriver updates and other fixes:\n\nThe Rage 128 video driver (r128) has been updated to provide 2D support\nfor all previously unsupported ATI Rage 128 hardware. DRI 3D support\nshould also work on the majority of Rage 128 hardware.\n\nBad page size assumptions in the ATI Radeon video driver (radeon) have\nbeen fixed to allow the driver to work properly on ia64 and other\narchitectures where the page size is not fixed.\n\nA long-standing XFree86 bug has been fixed. This bug occurs when any form\nof system clock skew (such as NTP clock synchronization, APM suspend/resume\ncycling on laptops, daylight savings time changeover, or even manually\nsetting the system clock forward or backward) could result in odd\napplication behavior, mouse and keyboard lockups, or even an X server hang\nor crash.\n\nThe S3 Savage driver (savage) has been updated to the upstream author\u0027s\nlatest version \"1.1.27t\", which should fix numerous bugs reported by\nvarious users, as well as adding support for some newer savage hardware.\n\nUsers are advised to upgrade to these updated packages, which are not\nvulnerable to the previously-mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:064",
"url": "https://access.redhat.com/errata/RHSA-2003:064"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_064.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 4.1.0 packages are available",
"tracking": {
"current_release_date": "2024-11-21T22:39:55+00:00",
"generator": {
"date": "2024-11-21T22:39:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2003:064",
"initial_release_date": "2003-06-25T15:51:00+00:00",
"revision_history": [
{
"date": "2003-06-25T15:51:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-21T22:39:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 7.1",
"product": {
"name": "Red Hat Linux 7.1",
"product_id": "Red Hat Linux 7.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.1"
}
}
},
{
"category": "product_name",
"name": "Red Hat Linux 7.2",
"product": {
"name": "Red Hat Linux 7.2",
"product_id": "Red Hat Linux 7.2",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1510",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616920"
}
],
"notes": [
{
"category": "description",
"text": "xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1510"
},
{
"category": "external",
"summary": "RHBZ#1616920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1510",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1510"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510"
}
],
"release_date": "2001-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:51:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.1",
"Red Hat Linux 7.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:064"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003_067
Vulnerability from csaf_redhat - Published: 2003-06-25 12:49 - Updated: 2024-11-21 22:40Summary
Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes
Notes
Topic
New XFree86 packages for Red Hat Linux 8.0 are now available which include
several security fixes, bug fixes, enhancements, and driver updates.
[Updated: June 30, 2003]
The XFree86 4.2.1-20 packages which were originally released in this
advisory were accidentally built with debugging info enabled due to a
temporary problem with our build system. Unfortunately, this problem was
not noticed during package testing, and caused the new XFree86 packages to
contain full debug symbol data, resulting in extremely large packages.
Note that the previously released packages are functional and should not
cause any problems on systems with adequate disk space. However we are
releasing new XFree86 4.2.1-21 packages to both minimize the download time
for people that have not yet updated XFree86 on their systems, and to
minimize the disk space footprint caused by this issue. Additionally, our
testing procedures have also been updated to automatically catch similar
issues in the future.
Red Hat apologizes for any inconvenience this may have caused you.
Details
XFree86 is an implementation of the X Window System providing the core
graphical user interface and video drivers in Red Hat Linux.
A number of security vulnerabilities have been discovered in XFree86 4.2.0:
- Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
- It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. (CAN-2003-0071)
- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
- The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. (CAN-2001-1409)
Driver updates and additions:
- Savage driver updated to Tim Roberts' latest version 1.1.27t.
- Added new "cyrix" driver from Alan Cox, which works much better on
MediaGX hardware.
- Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit),
Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98
head tracker (ur98)
- Backported apm driver from XFree86 CVS, DPMS support enhancements, and a
few accel fixes
- Backported ark driver from XFree86 CVS
- Backported chips driver from XFree86 CVS, with hardware mouse
cursor and 2D accleration fixes.
- Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS
Various bug fixes and enhancements:
- Bug fixes for the RENDER extension and libraries which improve stability
- Various fixes to the Xaw library
- A long standing problem in the X server has been fixed in which
the mouse, keyboard, or video would hang, or the server to go into an
endless loop whenever the system time was changed backward while X was
running
- Fixed a bug in both the Radeon and Rage 128 drivers which caused
crashes while using VMware with DGA when DRI is enabled
- The Matrox "mga" driver had some problems with multihead and the RENDER
extension which have been worked around.
- fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
- mkfontdir has been modified to force the permissions of the files it
generates to be mode 0644 ensuring they are world readable independant of
umask.
- Added a new option "ForceLegacyCRT" to the radeon driver to allow use
of legacy VGA monitors which can not be detected automatically. This
option is only safe to use in single-head setups and may cause serious
problems if used with dual-head.
- xterm session management is now enabled by default, whereas the stock
XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
- Removed and obsoleted the XFree86-xtrap-clients package, and merged it
into the main XFree86 package to simplify packaging
There are various other fixes included which users can review by examining
the RPM package changelog of any of the new XFree86 packages.
Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
are not vulnerable to the previously mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New XFree86 packages for Red Hat Linux 8.0 are now available which include\nseveral security fixes, bug fixes, enhancements, and driver updates.\n\n[Updated: June 30, 2003]\nThe XFree86 4.2.1-20 packages which were originally released in this\nadvisory were accidentally built with debugging info enabled due to a\ntemporary problem with our build system. Unfortunately, this problem was\nnot noticed during package testing, and caused the new XFree86 packages to\ncontain full debug symbol data, resulting in extremely large packages.\n\nNote that the previously released packages are functional and should not\ncause any problems on systems with adequate disk space. However we are\nreleasing new XFree86 4.2.1-21 packages to both minimize the download time\nfor people that have not yet updated XFree86 on their systems, and to\nminimize the disk space footprint caused by this issue. Additionally, our\ntesting procedures have also been updated to automatically catch similar\nissues in the future.\n\nRed Hat apologizes for any inconvenience this may have caused you.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System providing the core\ngraphical user interface and video drivers in Red Hat Linux. \n\nA number of security vulnerabilities have been discovered in XFree86 4.2.0:\n\n- Xterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\n- It is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. (CAN-2003-0071)\n\n- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\n- The X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. (CAN-2001-1409)\n\nDriver updates and additions:\n\n- Savage driver updated to Tim Roberts\u0027 latest version 1.1.27t.\n\n- Added new \"cyrix\" driver from Alan Cox, which works much better on\n MediaGX hardware.\n\n- Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit),\n Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98\n head tracker (ur98)\n\n- Backported apm driver from XFree86 CVS, DPMS support enhancements, and a \n few accel fixes\n\n- Backported ark driver from XFree86 CVS\n\n- Backported chips driver from XFree86 CVS, with hardware mouse\n cursor and 2D accleration fixes.\n\n- Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS\n\nVarious bug fixes and enhancements:\n\n- Bug fixes for the RENDER extension and libraries which improve stability\n\n- Various fixes to the Xaw library\n\n- A long standing problem in the X server has been fixed in which \n the mouse, keyboard, or video would hang, or the server to go into an \n endless loop whenever the system time was changed backward while X was \n running\n\n- Fixed a bug in both the Radeon and Rage 128 drivers which caused\n crashes while using VMware with DGA when DRI is enabled\n\n- The Matrox \"mga\" driver had some problems with multihead and the RENDER\n extension which have been worked around.\n\n- fc-cache is now run upon font package installation in all font\n directories containing fonts managed by fontconfig/Xft\n\n- mkfontdir has been modified to force the permissions of the files it\n generates to be mode 0644 ensuring they are world readable independant of\n umask.\n\n- Added a new option \"ForceLegacyCRT\" to the radeon driver to allow use \n of legacy VGA monitors which can not be detected automatically. This \n option is only safe to use in single-head setups and may cause serious \n problems if used with dual-head.\n\n- xterm session management is now enabled by default, whereas the stock\n XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream\n\n- Removed and obsoleted the XFree86-xtrap-clients package, and merged it\n into the main XFree86 package to simplify packaging\n\nThere are various other fixes included which users can review by examining\nthe RPM package changelog of any of the new XFree86 packages.\n\nUsers are advised to upgrade to these updated XFree86 4.2.1 packages, which\nare not vulnerable to the previously mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:067",
"url": "https://access.redhat.com/errata/RHSA-2003:067"
},
{
"category": "external",
"summary": "63509",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63509"
},
{
"category": "external",
"summary": "69978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=69978"
},
{
"category": "external",
"summary": "73678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=73678"
},
{
"category": "external",
"summary": "75155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=75155"
},
{
"category": "external",
"summary": "76154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=76154"
},
{
"category": "external",
"summary": "77542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=77542"
},
{
"category": "external",
"summary": "77930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=77930"
},
{
"category": "external",
"summary": "78804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=78804"
},
{
"category": "external",
"summary": "79488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=79488"
},
{
"category": "external",
"summary": "83303",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=83303"
},
{
"category": "external",
"summary": "84036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=84036"
},
{
"category": "external",
"summary": "88773",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=88773"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_067.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes",
"tracking": {
"current_release_date": "2024-11-21T22:40:08+00:00",
"generator": {
"date": "2024-11-21T22:40:08+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2003:067",
"initial_release_date": "2003-06-25T12:49:00+00:00",
"revision_history": [
{
"date": "2003-06-25T12:49:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-21T22:40:08+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 8.0",
"product": {
"name": "Red Hat Linux 8.0",
"product_id": "Red Hat Linux 8.0",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:8.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1472",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616917"
}
],
"notes": [
{
"category": "description",
"text": "Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1472"
},
{
"category": "external",
"summary": "RHBZ#1616917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1472",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472"
}
],
"release_date": "2002-09-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003:066
Vulnerability from csaf_redhat - Published: 2003-06-25 15:52 - Updated: 2025-11-21 17:25Summary
Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes
Notes
Topic
XFree86 is an implementation of the X Window System providing the
core graphical user interface and video drivers.
Updated XFree86 packages for Red Hat Linux 7.3 are now available which
include several security fixes, bug fixes, enhancements, and driver updates.
Details
Security fixes:
- Xterm, provides an escape sequence for reporting the current window
title. This escape sequence takes the current title and places it directly
on the command line. An attacker can craft an escape sequence that sets the
victim's Xterm window title to an arbitrary command, and then reports it to
the command line. Since it is not possible to embed a carriage return into
the window title, the attacker would then have to convince the victim to
press Enter for the shell to process the title as a command, although the
attacker could craft other escape sequences that might convince the victim
to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0063 to this issue.
- It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. (CAN-2003-0071)
- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
- The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. (CAN-2001-1409)
Driver updates and additions:
- Savage driver updated to Tim Roberts' latest version 1.1.27t
- New "cyrix" driver which works better on MediaGX hardware.
- New input drivers for Fujitsu Stylistic (fpit), Palmax
PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker
(ur98)
- Backported apm driver, DPMS support enhancements, and a few accel fixes
- Backported chips driver, with hardware mouse cursor and 2D acceleration
fixes
- Backported cirrus, i740, siliconmotion, and ark drivers
Various bug fixes and enhancements:
- Stability improvements to RENDER extension and libraries
- Various fixes to the Xaw library
- Fix a long standing problem in the X server where the mouse, keyboard, or
video would hang, or the server to go into an endless loop whenever the
system time was changed backwards
- Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA
when DRI is enabled
- Work around some multihead and RENDER exention problems in the Matrox
"mga" driver
- fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
- mkfontdir now forces the permissions of the files it generates to be mode
0644 to ensure they are world readable independant of umask
- A new option "ForceLegacyCRT" to the radeon driver allows use
of legacy VGA monitors which can not be detected automatically. This
option is only safe to use in single-head setups and may cause serious
problems if used with dual-head.
- xterm session management is now enabled by default, whereas the stock
XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
- Removed and obsoleted the XFree86-xtrap-clients package, now merged
into the main XFree86 package
- Added support for previously unsupported ATI Rage 128 video hardware
- Fixed Polish euro support
- Added neomagic Xvideo support which may work for some users
- Added fix for deadkey-quotedbl in ISO8859-15
- Disabled debug messages in Cirrus Logic driver
- Fixed a bug in the VESA driver, where the X server would crash with
an FPE when the DisplaySize option was used
- Fix to ATI Mach64 support which was out of PCI specs causing problems
on some Dell and IBM servers
- Fix a problem which caused certain combinations of Radeon and Rage 128
hardware and particular motherboards to hang, due to bus mastering
getting disabled when VT switching.
There are various other fixes included which users can review by examining
the RPM package changelog of any of the new XFree86 packages.
Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
are not vulnerable to the previously mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "XFree86 is an implementation of the X Window System providing the\ncore graphical user interface and video drivers.\n\nUpdated XFree86 packages for Red Hat Linux 7.3 are now available which\ninclude several security fixes, bug fixes, enhancements, and driver updates.",
"title": "Topic"
},
{
"category": "general",
"text": "Security fixes:\n\n- Xterm, provides an escape sequence for reporting the current window\ntitle. This escape sequence takes the current title and places it directly\non the command line. An attacker can craft an escape sequence that sets the\nvictim\u0027s Xterm window title to an arbitrary command, and then reports it to\nthe command line. Since it is not possible to embed a carriage return into\nthe window title, the attacker would then have to convince the victim to\npress Enter for the shell to process the title as a command, although the\nattacker could craft other escape sequences that might convince the victim\nto do so. The Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CAN-2003-0063 to this issue.\n\n- It is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. (CAN-2003-0071)\n\n- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\n- The X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. (CAN-2001-1409)\n\nDriver updates and additions:\n\n- Savage driver updated to Tim Roberts\u0027 latest version 1.1.27t\n\n- New \"cyrix\" driver which works better on MediaGX hardware.\n\n- New input drivers for Fujitsu Stylistic (fpit), Palmax \n PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker \n (ur98)\n\n- Backported apm driver, DPMS support enhancements, and a few accel fixes\n\n- Backported chips driver, with hardware mouse cursor and 2D acceleration \n fixes\n\n- Backported cirrus, i740, siliconmotion, and ark drivers\n\nVarious bug fixes and enhancements:\n\n- Stability improvements to RENDER extension and libraries\n\n- Various fixes to the Xaw library\n\n- Fix a long standing problem in the X server where the mouse, keyboard, or \n video would hang, or the server to go into an endless loop whenever the \n system time was changed backwards\n\n- Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA \n when DRI is enabled\n\n- Work around some multihead and RENDER exention problems in the Matrox \n \"mga\" driver\n\n- fc-cache is now run upon font package installation in all font\n directories containing fonts managed by fontconfig/Xft\n\n- mkfontdir now forces the permissions of the files it generates to be mode \n 0644 to ensure they are world readable independant of umask\n\n- A new option \"ForceLegacyCRT\" to the radeon driver allows use \n of legacy VGA monitors which can not be detected automatically. This \n option is only safe to use in single-head setups and may cause serious \n problems if used with dual-head.\n\n- xterm session management is now enabled by default, whereas the stock\n XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream\n\n- Removed and obsoleted the XFree86-xtrap-clients package, now merged\n into the main XFree86 package\n\n- Added support for previously unsupported ATI Rage 128 video hardware\n\n- Fixed Polish euro support\n\n- Added neomagic Xvideo support which may work for some users\n\n- Added fix for deadkey-quotedbl in ISO8859-15\n\n- Disabled debug messages in Cirrus Logic driver\n\n- Fixed a bug in the VESA driver, where the X server would crash with\n an FPE when the DisplaySize option was used\n\n- Fix to ATI Mach64 support which was out of PCI specs causing problems \n on some Dell and IBM servers\n\n- Fix a problem which caused certain combinations of Radeon and Rage 128\n hardware and particular motherboards to hang, due to bus mastering\n getting disabled when VT switching.\n\nThere are various other fixes included which users can review by examining\nthe RPM package changelog of any of the new XFree86 packages.\n\nUsers are advised to upgrade to these updated XFree86 4.2.1 packages, which\nare not vulnerable to the previously mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:066",
"url": "https://access.redhat.com/errata/RHSA-2003:066"
},
{
"category": "external",
"summary": "40729",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=40729"
},
{
"category": "external",
"summary": "50282",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=50282"
},
{
"category": "external",
"summary": "53231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=53231"
},
{
"category": "external",
"summary": "53329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=53329"
},
{
"category": "external",
"summary": "58188",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=58188"
},
{
"category": "external",
"summary": "60895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=60895"
},
{
"category": "external",
"summary": "62171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62171"
},
{
"category": "external",
"summary": "62442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62442"
},
{
"category": "external",
"summary": "62820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62820"
},
{
"category": "external",
"summary": "63593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63593"
},
{
"category": "external",
"summary": "63609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63609"
},
{
"category": "external",
"summary": "64559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=64559"
},
{
"category": "external",
"summary": "64970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=64970"
},
{
"category": "external",
"summary": "65136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65136"
},
{
"category": "external",
"summary": "65330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65330"
},
{
"category": "external",
"summary": "65704",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65704"
},
{
"category": "external",
"summary": "69743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=69743"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_066.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes",
"tracking": {
"current_release_date": "2025-11-21T17:25:39+00:00",
"generator": {
"date": "2025-11-21T17:25:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2003:066",
"initial_release_date": "2003-06-25T15:52:00+00:00",
"revision_history": [
{
"date": "2003-06-25T15:52:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:25:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 7.3",
"product": {
"name": "Red Hat Linux 7.3",
"product_id": "Red Hat Linux 7.3",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1472",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616917"
}
],
"notes": [
{
"category": "description",
"text": "Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1472"
},
{
"category": "external",
"summary": "RHBZ#1616917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1472",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472"
}
],
"release_date": "2002-09-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003:067
Vulnerability from csaf_redhat - Published: 2003-06-25 12:49 - Updated: 2025-11-21 17:25Summary
Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes
Notes
Topic
New XFree86 packages for Red Hat Linux 8.0 are now available which include
several security fixes, bug fixes, enhancements, and driver updates.
[Updated: June 30, 2003]
The XFree86 4.2.1-20 packages which were originally released in this
advisory were accidentally built with debugging info enabled due to a
temporary problem with our build system. Unfortunately, this problem was
not noticed during package testing, and caused the new XFree86 packages to
contain full debug symbol data, resulting in extremely large packages.
Note that the previously released packages are functional and should not
cause any problems on systems with adequate disk space. However we are
releasing new XFree86 4.2.1-21 packages to both minimize the download time
for people that have not yet updated XFree86 on their systems, and to
minimize the disk space footprint caused by this issue. Additionally, our
testing procedures have also been updated to automatically catch similar
issues in the future.
Red Hat apologizes for any inconvenience this may have caused you.
Details
XFree86 is an implementation of the X Window System providing the core
graphical user interface and video drivers in Red Hat Linux.
A number of security vulnerabilities have been discovered in XFree86 4.2.0:
- Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
- It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. (CAN-2003-0071)
- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
- The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. (CAN-2001-1409)
Driver updates and additions:
- Savage driver updated to Tim Roberts' latest version 1.1.27t.
- Added new "cyrix" driver from Alan Cox, which works much better on
MediaGX hardware.
- Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit),
Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98
head tracker (ur98)
- Backported apm driver from XFree86 CVS, DPMS support enhancements, and a
few accel fixes
- Backported ark driver from XFree86 CVS
- Backported chips driver from XFree86 CVS, with hardware mouse
cursor and 2D accleration fixes.
- Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS
Various bug fixes and enhancements:
- Bug fixes for the RENDER extension and libraries which improve stability
- Various fixes to the Xaw library
- A long standing problem in the X server has been fixed in which
the mouse, keyboard, or video would hang, or the server to go into an
endless loop whenever the system time was changed backward while X was
running
- Fixed a bug in both the Radeon and Rage 128 drivers which caused
crashes while using VMware with DGA when DRI is enabled
- The Matrox "mga" driver had some problems with multihead and the RENDER
extension which have been worked around.
- fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
- mkfontdir has been modified to force the permissions of the files it
generates to be mode 0644 ensuring they are world readable independant of
umask.
- Added a new option "ForceLegacyCRT" to the radeon driver to allow use
of legacy VGA monitors which can not be detected automatically. This
option is only safe to use in single-head setups and may cause serious
problems if used with dual-head.
- xterm session management is now enabled by default, whereas the stock
XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
- Removed and obsoleted the XFree86-xtrap-clients package, and merged it
into the main XFree86 package to simplify packaging
There are various other fixes included which users can review by examining
the RPM package changelog of any of the new XFree86 packages.
Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
are not vulnerable to the previously mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "New XFree86 packages for Red Hat Linux 8.0 are now available which include\nseveral security fixes, bug fixes, enhancements, and driver updates.\n\n[Updated: June 30, 2003]\nThe XFree86 4.2.1-20 packages which were originally released in this\nadvisory were accidentally built with debugging info enabled due to a\ntemporary problem with our build system. Unfortunately, this problem was\nnot noticed during package testing, and caused the new XFree86 packages to\ncontain full debug symbol data, resulting in extremely large packages.\n\nNote that the previously released packages are functional and should not\ncause any problems on systems with adequate disk space. However we are\nreleasing new XFree86 4.2.1-21 packages to both minimize the download time\nfor people that have not yet updated XFree86 on their systems, and to\nminimize the disk space footprint caused by this issue. Additionally, our\ntesting procedures have also been updated to automatically catch similar\nissues in the future.\n\nRed Hat apologizes for any inconvenience this may have caused you.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System providing the core\ngraphical user interface and video drivers in Red Hat Linux. \n\nA number of security vulnerabilities have been discovered in XFree86 4.2.0:\n\n- Xterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\n- It is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. (CAN-2003-0071)\n\n- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\n- The X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. (CAN-2001-1409)\n\nDriver updates and additions:\n\n- Savage driver updated to Tim Roberts\u0027 latest version 1.1.27t.\n\n- Added new \"cyrix\" driver from Alan Cox, which works much better on\n MediaGX hardware.\n\n- Added new input drivers from Alan Cox for Fujitsu Stylistic (fpit),\n Palmax PD1000/PD1100 Input driver (palmax), Union Reality UR-98\n head tracker (ur98)\n\n- Backported apm driver from XFree86 CVS, DPMS support enhancements, and a \n few accel fixes\n\n- Backported ark driver from XFree86 CVS\n\n- Backported chips driver from XFree86 CVS, with hardware mouse\n cursor and 2D accleration fixes.\n\n- Backported cirrus i740, siliconmotion, and ark drivers from XFree86 CVS\n\nVarious bug fixes and enhancements:\n\n- Bug fixes for the RENDER extension and libraries which improve stability\n\n- Various fixes to the Xaw library\n\n- A long standing problem in the X server has been fixed in which \n the mouse, keyboard, or video would hang, or the server to go into an \n endless loop whenever the system time was changed backward while X was \n running\n\n- Fixed a bug in both the Radeon and Rage 128 drivers which caused\n crashes while using VMware with DGA when DRI is enabled\n\n- The Matrox \"mga\" driver had some problems with multihead and the RENDER\n extension which have been worked around.\n\n- fc-cache is now run upon font package installation in all font\n directories containing fonts managed by fontconfig/Xft\n\n- mkfontdir has been modified to force the permissions of the files it\n generates to be mode 0644 ensuring they are world readable independant of\n umask.\n\n- Added a new option \"ForceLegacyCRT\" to the radeon driver to allow use \n of legacy VGA monitors which can not be detected automatically. This \n option is only safe to use in single-head setups and may cause serious \n problems if used with dual-head.\n\n- xterm session management is now enabled by default, whereas the stock\n XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream\n\n- Removed and obsoleted the XFree86-xtrap-clients package, and merged it\n into the main XFree86 package to simplify packaging\n\nThere are various other fixes included which users can review by examining\nthe RPM package changelog of any of the new XFree86 packages.\n\nUsers are advised to upgrade to these updated XFree86 4.2.1 packages, which\nare not vulnerable to the previously mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:067",
"url": "https://access.redhat.com/errata/RHSA-2003:067"
},
{
"category": "external",
"summary": "63509",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63509"
},
{
"category": "external",
"summary": "69978",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=69978"
},
{
"category": "external",
"summary": "73678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=73678"
},
{
"category": "external",
"summary": "75155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=75155"
},
{
"category": "external",
"summary": "76154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=76154"
},
{
"category": "external",
"summary": "77542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=77542"
},
{
"category": "external",
"summary": "77930",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=77930"
},
{
"category": "external",
"summary": "78804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=78804"
},
{
"category": "external",
"summary": "79488",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=79488"
},
{
"category": "external",
"summary": "83303",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=83303"
},
{
"category": "external",
"summary": "84036",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=84036"
},
{
"category": "external",
"summary": "88773",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=88773"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_067.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes",
"tracking": {
"current_release_date": "2025-11-21T17:25:40+00:00",
"generator": {
"date": "2025-11-21T17:25:40+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2003:067",
"initial_release_date": "2003-06-25T12:49:00+00:00",
"revision_history": [
{
"date": "2003-06-25T12:49:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:25:40+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 8.0",
"product": {
"name": "Red Hat Linux 8.0",
"product_id": "Red Hat Linux 8.0",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:8.0"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1472",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616917"
}
],
"notes": [
{
"category": "description",
"text": "Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1472"
},
{
"category": "external",
"summary": "RHBZ#1616917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1472",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472"
}
],
"release_date": "2002-09-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 8.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:49:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 8.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:067"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003_065
Vulnerability from csaf_redhat - Published: 2003-06-25 12:23 - Updated: 2024-11-21 22:40Summary
Red Hat Security Advisory: XFree86 security update
Notes
Topic
Updated XFree86 packages that resolve various security issues and
additionally provide a number of bug fixes and enhancements are now
available for Red Hat Enterprise Linux 2.1.
Details
XFree86 is an implementation of the X Window System, which provides the
graphical user interface, video drivers, etc. for Linux systems.
A number of security vulnerabilities have been found and fixed. In
addition, various other bug fixes, driver updates, and other enhancements
have been made.
Security fixes:
Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.
The xdm display manager, with the authComplain variable set to false,
allows arbitrary attackers to connect to the X server if the xdm auth
directory does not exist. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.
These erratum packages also contain an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to
this issue.
Driver updates and other fixes:
The Rage 128 video driver (r128) has been updated to provide 2D support
for all previously unsupported ATI Rage 128 hardware. DRI 3D support
should also work on the majority of Rage 128 hardware.
Bad page size assumptions in the ATI Radeon video driver (radeon) have
been fixed, allowing the driver to work properly on ia64 and other
architectures where the page size is not fixed.
A long-standing XFree86 bug has been fixed. This bug occurs when any form
of system clock skew (such as NTP clock synchronization, APM suspend/resume
cycling on laptops, daylight savings time changeover, or even manually
setting the system clock forward or backward) could result in odd
application behavior, mouse and keyboard lockups, or even an X server hang
or crash.
The S3 Savage driver (savage) has been updated to the upstream author's
latest version "1.1.27t", which should fix numerous bugs reported by
various users, as well as adding support for some newer savage hardware.
Users are advised to upgrade to these updated packages, which contain
XFree86 version 4.1.0 with patches correcting these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated XFree86 packages that resolve various security issues and\nadditionally provide a number of bug fixes and enhancements are now\navailable for Red Hat Enterprise Linux 2.1.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System, which provides the\ngraphical user interface, video drivers, etc. for Linux systems.\n\nA number of security vulnerabilities have been found and fixed. In\naddition, various other bug fixes, driver updates, and other enhancements\nhave been made.\n\nSecurity fixes:\n\nXterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\nIt is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.\n\nThe xdm display manager, with the authComplain variable set to false,\nallows arbitrary attackers to connect to the X server if the xdm auth\ndirectory does not exist. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.\n\nThese erratum packages also contain an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\nThe X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to\nthis issue.\n\nDriver updates and other fixes:\n\nThe Rage 128 video driver (r128) has been updated to provide 2D support\nfor all previously unsupported ATI Rage 128 hardware. DRI 3D support\nshould also work on the majority of Rage 128 hardware.\n\nBad page size assumptions in the ATI Radeon video driver (radeon) have\nbeen fixed, allowing the driver to work properly on ia64 and other\narchitectures where the page size is not fixed.\n\nA long-standing XFree86 bug has been fixed. This bug occurs when any form\nof system clock skew (such as NTP clock synchronization, APM suspend/resume\ncycling on laptops, daylight savings time changeover, or even manually\nsetting the system clock forward or backward) could result in odd\napplication behavior, mouse and keyboard lockups, or even an X server hang\nor crash.\n\nThe S3 Savage driver (savage) has been updated to the upstream author\u0027s\nlatest version \"1.1.27t\", which should fix numerous bugs reported by\nvarious users, as well as adding support for some newer savage hardware.\n\nUsers are advised to upgrade to these updated packages, which contain\nXFree86 version 4.1.0 with patches correcting these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:065",
"url": "https://access.redhat.com/errata/RHSA-2003:065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_065.json"
}
],
"title": "Red Hat Security Advisory: XFree86 security update",
"tracking": {
"current_release_date": "2024-11-21T22:40:00+00:00",
"generator": {
"date": "2024-11-21T22:40:00+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2003:065",
"initial_release_date": "2003-06-25T12:23:00+00:00",
"revision_history": [
{
"date": "2003-06-25T12:23:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-21T22:40:00+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product": {
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_id": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Linux Advanced Workstation 2.1",
"product": {
"name": "Red Hat Linux Advanced Workstation 2.1",
"product_id": "Red Hat Linux Advanced Workstation 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::aw"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 2.1",
"product": {
"name": "Red Hat Enterprise Linux ES version 2.1",
"product_id": "Red Hat Enterprise Linux ES version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 2.1",
"product": {
"name": "Red Hat Enterprise Linux WS version 2.1",
"product_id": "Red Hat Enterprise Linux WS version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1510",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616920"
}
],
"notes": [
{
"category": "description",
"text": "xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1510"
},
{
"category": "external",
"summary": "RHBZ#1616920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1510",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1510"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510"
}
],
"release_date": "2001-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003_066
Vulnerability from csaf_redhat - Published: 2003-06-25 15:52 - Updated: 2024-11-21 22:40Summary
Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes
Notes
Topic
XFree86 is an implementation of the X Window System providing the
core graphical user interface and video drivers.
Updated XFree86 packages for Red Hat Linux 7.3 are now available which
include several security fixes, bug fixes, enhancements, and driver updates.
Details
Security fixes:
- Xterm, provides an escape sequence for reporting the current window
title. This escape sequence takes the current title and places it directly
on the command line. An attacker can craft an escape sequence that sets the
victim's Xterm window title to an arbitrary command, and then reports it to
the command line. Since it is not possible to embed a carriage return into
the window title, the attacker would then have to convince the victim to
press Enter for the shell to process the title as a command, although the
attacker could craft other escape sequences that might convince the victim
to do so. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0063 to this issue.
- It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. (CAN-2003-0071)
- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
- The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. (CAN-2001-1409)
Driver updates and additions:
- Savage driver updated to Tim Roberts' latest version 1.1.27t
- New "cyrix" driver which works better on MediaGX hardware.
- New input drivers for Fujitsu Stylistic (fpit), Palmax
PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker
(ur98)
- Backported apm driver, DPMS support enhancements, and a few accel fixes
- Backported chips driver, with hardware mouse cursor and 2D acceleration
fixes
- Backported cirrus, i740, siliconmotion, and ark drivers
Various bug fixes and enhancements:
- Stability improvements to RENDER extension and libraries
- Various fixes to the Xaw library
- Fix a long standing problem in the X server where the mouse, keyboard, or
video would hang, or the server to go into an endless loop whenever the
system time was changed backwards
- Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA
when DRI is enabled
- Work around some multihead and RENDER exention problems in the Matrox
"mga" driver
- fc-cache is now run upon font package installation in all font
directories containing fonts managed by fontconfig/Xft
- mkfontdir now forces the permissions of the files it generates to be mode
0644 to ensure they are world readable independant of umask
- A new option "ForceLegacyCRT" to the radeon driver allows use
of legacy VGA monitors which can not be detected automatically. This
option is only safe to use in single-head setups and may cause serious
problems if used with dual-head.
- xterm session management is now enabled by default, whereas the stock
XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream
- Removed and obsoleted the XFree86-xtrap-clients package, now merged
into the main XFree86 package
- Added support for previously unsupported ATI Rage 128 video hardware
- Fixed Polish euro support
- Added neomagic Xvideo support which may work for some users
- Added fix for deadkey-quotedbl in ISO8859-15
- Disabled debug messages in Cirrus Logic driver
- Fixed a bug in the VESA driver, where the X server would crash with
an FPE when the DisplaySize option was used
- Fix to ATI Mach64 support which was out of PCI specs causing problems
on some Dell and IBM servers
- Fix a problem which caused certain combinations of Radeon and Rage 128
hardware and particular motherboards to hang, due to bus mastering
getting disabled when VT switching.
There are various other fixes included which users can review by examining
the RPM package changelog of any of the new XFree86 packages.
Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
are not vulnerable to the previously mentioned security issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "XFree86 is an implementation of the X Window System providing the\ncore graphical user interface and video drivers.\n\nUpdated XFree86 packages for Red Hat Linux 7.3 are now available which\ninclude several security fixes, bug fixes, enhancements, and driver updates.",
"title": "Topic"
},
{
"category": "general",
"text": "Security fixes:\n\n- Xterm, provides an escape sequence for reporting the current window\ntitle. This escape sequence takes the current title and places it directly\non the command line. An attacker can craft an escape sequence that sets the\nvictim\u0027s Xterm window title to an arbitrary command, and then reports it to\nthe command line. Since it is not possible to embed a carriage return into\nthe window title, the attacker would then have to convince the victim to\npress Enter for the shell to process the title as a command, although the\nattacker could craft other escape sequences that might convince the victim\nto do so. The Common Vulnerabilities and Exposures project (cve.mitre.org)\nhas assigned the name CAN-2003-0063 to this issue.\n\n- It is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. (CAN-2003-0071)\n\n- XFree86 4.2.1 also contains an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\n- The X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. (CAN-2001-1409)\n\nDriver updates and additions:\n\n- Savage driver updated to Tim Roberts\u0027 latest version 1.1.27t\n\n- New \"cyrix\" driver which works better on MediaGX hardware.\n\n- New input drivers for Fujitsu Stylistic (fpit), Palmax \n PD1000/PD1100 Input driver (palmax), Union Reality UR-98 head tracker \n (ur98)\n\n- Backported apm driver, DPMS support enhancements, and a few accel fixes\n\n- Backported chips driver, with hardware mouse cursor and 2D acceleration \n fixes\n\n- Backported cirrus, i740, siliconmotion, and ark drivers\n\nVarious bug fixes and enhancements:\n\n- Stability improvements to RENDER extension and libraries\n\n- Various fixes to the Xaw library\n\n- Fix a long standing problem in the X server where the mouse, keyboard, or \n video would hang, or the server to go into an endless loop whenever the \n system time was changed backwards\n\n- Fix a crash in the Radeon and Rage 128 drivers using VMware with DGA \n when DRI is enabled\n\n- Work around some multihead and RENDER exention problems in the Matrox \n \"mga\" driver\n\n- fc-cache is now run upon font package installation in all font\n directories containing fonts managed by fontconfig/Xft\n\n- mkfontdir now forces the permissions of the files it generates to be mode \n 0644 to ensure they are world readable independant of umask\n\n- A new option \"ForceLegacyCRT\" to the radeon driver allows use \n of legacy VGA monitors which can not be detected automatically. This \n option is only safe to use in single-head setups and may cause serious \n problems if used with dual-head.\n\n- xterm session management is now enabled by default, whereas the stock\n XFree86 default in 4.2.0/4.2.1 was accidentally disabled upstream\n\n- Removed and obsoleted the XFree86-xtrap-clients package, now merged\n into the main XFree86 package\n\n- Added support for previously unsupported ATI Rage 128 video hardware\n\n- Fixed Polish euro support\n\n- Added neomagic Xvideo support which may work for some users\n\n- Added fix for deadkey-quotedbl in ISO8859-15\n\n- Disabled debug messages in Cirrus Logic driver\n\n- Fixed a bug in the VESA driver, where the X server would crash with\n an FPE when the DisplaySize option was used\n\n- Fix to ATI Mach64 support which was out of PCI specs causing problems \n on some Dell and IBM servers\n\n- Fix a problem which caused certain combinations of Radeon and Rage 128\n hardware and particular motherboards to hang, due to bus mastering\n getting disabled when VT switching.\n\nThere are various other fixes included which users can review by examining\nthe RPM package changelog of any of the new XFree86 packages.\n\nUsers are advised to upgrade to these updated XFree86 4.2.1 packages, which\nare not vulnerable to the previously mentioned security issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:066",
"url": "https://access.redhat.com/errata/RHSA-2003:066"
},
{
"category": "external",
"summary": "40729",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=40729"
},
{
"category": "external",
"summary": "50282",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=50282"
},
{
"category": "external",
"summary": "53231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=53231"
},
{
"category": "external",
"summary": "53329",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=53329"
},
{
"category": "external",
"summary": "58188",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=58188"
},
{
"category": "external",
"summary": "60895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=60895"
},
{
"category": "external",
"summary": "62171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62171"
},
{
"category": "external",
"summary": "62442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62442"
},
{
"category": "external",
"summary": "62820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=62820"
},
{
"category": "external",
"summary": "63593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63593"
},
{
"category": "external",
"summary": "63609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=63609"
},
{
"category": "external",
"summary": "64559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=64559"
},
{
"category": "external",
"summary": "64970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=64970"
},
{
"category": "external",
"summary": "65136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65136"
},
{
"category": "external",
"summary": "65330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65330"
},
{
"category": "external",
"summary": "65704",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=65704"
},
{
"category": "external",
"summary": "69743",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=69743"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_066.json"
}
],
"title": "Red Hat Security Advisory: : Updated XFree86 packages provide security and bug fixes",
"tracking": {
"current_release_date": "2024-11-21T22:40:05+00:00",
"generator": {
"date": "2024-11-21T22:40:05+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2003:066",
"initial_release_date": "2003-06-25T15:52:00+00:00",
"revision_history": [
{
"date": "2003-06-25T15:52:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-21T22:40:05+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Linux 7.3",
"product": {
"name": "Red Hat Linux 7.3",
"product_id": "Red Hat Linux 7.3",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:linux:7.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1472",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616917"
}
],
"notes": [
{
"category": "description",
"text": "Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LD_PRELOAD environment variable that points to a malicious module.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1472"
},
{
"category": "external",
"summary": "RHBZ#1616917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616917"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1472",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1472"
}
],
"release_date": "2002-09-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Linux 7.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T15:52:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Linux 7.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:066"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
RHSA-2003:065
Vulnerability from csaf_redhat - Published: 2003-06-25 12:23 - Updated: 2025-11-21 17:25Summary
Red Hat Security Advisory: XFree86 security update
Notes
Topic
Updated XFree86 packages that resolve various security issues and
additionally provide a number of bug fixes and enhancements are now
available for Red Hat Enterprise Linux 2.1.
Details
XFree86 is an implementation of the X Window System, which provides the
graphical user interface, video drivers, etc. for Linux systems.
A number of security vulnerabilities have been found and fixed. In
addition, various other bug fixes, driver updates, and other enhancements
have been made.
Security fixes:
Xterm, provided as part of the XFree86 packages, provides an escape
sequence for reporting the current window title. This escape sequence
essentially takes the current title and places it directly on the command
line. An attacker can craft an escape sequence that sets the victim's Xterm
window title to an arbitrary command, and then reports it to the command
line. Since it is not possible to embed a carriage return into the window
title, the attacker would then have to convince the victim to press Enter
for the shell to process the title as a command, although the attacker
could craft other escape sequences that might convince the victim to do so.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0063 to this issue.
It is possible to lock up versions of Xterm by sending an invalid DEC
UDK escape sequence. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.
The xdm display manager, with the authComplain variable set to false,
allows arbitrary attackers to connect to the X server if the xdm auth
directory does not exist. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.
These erratum packages also contain an updated fix for CAN-2002-0164, a
vulnerability in the MIT-SHM extension of the X server that allows local
users to read and write arbitrary shared memory. The original fix did not
cover the case where the X server is started from xdm.
The X server was setting the /dev/dri directory permissions incorrectly,
which resulted in the directory being world writable. It now sets the
directory permissions to a safe value. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to
this issue.
Driver updates and other fixes:
The Rage 128 video driver (r128) has been updated to provide 2D support
for all previously unsupported ATI Rage 128 hardware. DRI 3D support
should also work on the majority of Rage 128 hardware.
Bad page size assumptions in the ATI Radeon video driver (radeon) have
been fixed, allowing the driver to work properly on ia64 and other
architectures where the page size is not fixed.
A long-standing XFree86 bug has been fixed. This bug occurs when any form
of system clock skew (such as NTP clock synchronization, APM suspend/resume
cycling on laptops, daylight savings time changeover, or even manually
setting the system clock forward or backward) could result in odd
application behavior, mouse and keyboard lockups, or even an X server hang
or crash.
The S3 Savage driver (savage) has been updated to the upstream author's
latest version "1.1.27t", which should fix numerous bugs reported by
various users, as well as adding support for some newer savage hardware.
Users are advised to upgrade to these updated packages, which contain
XFree86 version 4.1.0 with patches correcting these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated XFree86 packages that resolve various security issues and\nadditionally provide a number of bug fixes and enhancements are now\navailable for Red Hat Enterprise Linux 2.1.",
"title": "Topic"
},
{
"category": "general",
"text": "XFree86 is an implementation of the X Window System, which provides the\ngraphical user interface, video drivers, etc. for Linux systems.\n\nA number of security vulnerabilities have been found and fixed. In\naddition, various other bug fixes, driver updates, and other enhancements\nhave been made.\n\nSecurity fixes:\n\nXterm, provided as part of the XFree86 packages, provides an escape\nsequence for reporting the current window title. This escape sequence\nessentially takes the current title and places it directly on the command\nline. An attacker can craft an escape sequence that sets the victim\u0027s Xterm\nwindow title to an arbitrary command, and then reports it to the command\nline. Since it is not possible to embed a carriage return into the window\ntitle, the attacker would then have to convince the victim to press Enter\nfor the shell to process the title as a command, although the attacker\ncould craft other escape sequences that might convince the victim to do so.\nThe Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2003-0063 to this issue.\n\nIt is possible to lock up versions of Xterm by sending an invalid DEC\nUDK escape sequence. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2003-0071 to this issue.\n\nThe xdm display manager, with the authComplain variable set to false,\nallows arbitrary attackers to connect to the X server if the xdm auth\ndirectory does not exist. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2002-1510 to this issue.\n\nThese erratum packages also contain an updated fix for CAN-2002-0164, a\nvulnerability in the MIT-SHM extension of the X server that allows local\nusers to read and write arbitrary shared memory. The original fix did not\ncover the case where the X server is started from xdm.\n\nThe X server was setting the /dev/dri directory permissions incorrectly,\nwhich resulted in the directory being world writable. It now sets the\ndirectory permissions to a safe value. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2001-1409 to\nthis issue.\n\nDriver updates and other fixes:\n\nThe Rage 128 video driver (r128) has been updated to provide 2D support\nfor all previously unsupported ATI Rage 128 hardware. DRI 3D support\nshould also work on the majority of Rage 128 hardware.\n\nBad page size assumptions in the ATI Radeon video driver (radeon) have\nbeen fixed, allowing the driver to work properly on ia64 and other\narchitectures where the page size is not fixed.\n\nA long-standing XFree86 bug has been fixed. This bug occurs when any form\nof system clock skew (such as NTP clock synchronization, APM suspend/resume\ncycling on laptops, daylight savings time changeover, or even manually\nsetting the system clock forward or backward) could result in odd\napplication behavior, mouse and keyboard lockups, or even an X server hang\nor crash.\n\nThe S3 Savage driver (savage) has been updated to the upstream author\u0027s\nlatest version \"1.1.27t\", which should fix numerous bugs reported by\nvarious users, as well as adding support for some newer savage hardware.\n\nUsers are advised to upgrade to these updated packages, which contain\nXFree86 version 4.1.0 with patches correcting these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2003:065",
"url": "https://access.redhat.com/errata/RHSA-2003:065"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2003/rhsa-2003_065.json"
}
],
"title": "Red Hat Security Advisory: XFree86 security update",
"tracking": {
"current_release_date": "2025-11-21T17:25:38+00:00",
"generator": {
"date": "2025-11-21T17:25:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHSA-2003:065",
"initial_release_date": "2003-06-25T12:23:00+00:00",
"revision_history": [
{
"date": "2003-06-25T12:23:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2003-06-25T00:00:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:25:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product": {
"name": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_id": "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::as"
}
}
},
{
"category": "product_name",
"name": "Red Hat Linux Advanced Workstation 2.1",
"product": {
"name": "Red Hat Linux Advanced Workstation 2.1",
"product_id": "Red Hat Linux Advanced Workstation 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::aw"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux ES version 2.1",
"product": {
"name": "Red Hat Enterprise Linux ES version 2.1",
"product_id": "Red Hat Enterprise Linux ES version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::es"
}
}
},
{
"category": "product_name",
"name": "Red Hat Enterprise Linux WS version 2.1",
"product": {
"name": "Red Hat Enterprise Linux WS version 2.1",
"product_id": "Red Hat Enterprise Linux WS version 2.1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:2.1::ws"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2001-1409",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616706"
}
],
"notes": [
{
"category": "description",
"text": "dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or create files in the root file system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2001-1409"
},
{
"category": "external",
"summary": "RHBZ#1616706",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616706"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2001-1409",
"url": "https://www.cve.org/CVERecord?id=CVE-2001-1409"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1409"
}
],
"release_date": "2001-08-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-0164",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616747"
}
],
"notes": [
{
"category": "description",
"text": "Vulnerability in the MIT-SHM extension of the X server on Linux (XFree86) 4.2.1 and earlier allows local users to read and write arbitrary shared memory, possibly to cause a denial of service or gain privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-0164"
},
{
"category": "external",
"summary": "RHBZ#1616747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-0164"
}
],
"release_date": "2002-05-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2002-1510",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616920"
}
],
"notes": [
{
"category": "description",
"text": "xdm, with the authComplain variable set to false, allows arbitrary attackers to connect to the X server if the xdm auth directory does not exist.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2002-1510"
},
{
"category": "external",
"summary": "RHBZ#1616920",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616920"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2002-1510",
"url": "https://www.cve.org/CVERecord?id=CVE-2002-1510"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2002-1510"
}
],
"release_date": "2001-12-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0063",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616948"
}
],
"notes": [
{
"category": "description",
"text": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0063"
},
{
"category": "external",
"summary": "RHBZ#1616948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "security flaw"
},
{
"cve": "CVE-2003-0071",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1616952"
}
],
"notes": [
{
"category": "description",
"text": "The DEC UDK processing feature in the xterm terminal emulator in XFree86 4.2.99.4 and earlier allows attackers to cause a denial of service via a certain character escape sequence that causes the terminal to enter a tight loop.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "security flaw",
"title": "Vulnerability summary"
}
],
"product_status": {
"fixed": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2003-0071"
},
{
"category": "external",
"summary": "RHBZ#1616952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0071"
}
],
"release_date": "2003-02-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2003-06-25T12:23:00+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nPlease note that this update is available via Red Hat Network. To use Red\nHat Network, launch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.",
"product_ids": [
"Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ",
"Red Hat Enterprise Linux ES version 2.1",
"Red Hat Enterprise Linux WS version 2.1",
"Red Hat Linux Advanced Workstation 2.1"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2003:065"
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "security flaw"
}
]
}
FKIE_CVE-2003-0063
Vulnerability from fkie_nvd - Published: 2003-03-03 05:00 - Updated: 2025-04-03 01:03
Severity ?
Summary
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| xfree86_project | x11r6 | 4.0 | |
| xfree86_project | x11r6 | 4.0.1 | |
| xfree86_project | x11r6 | 4.0.3 | |
| xfree86_project | x11r6 | 4.1.0 | |
| xfree86_project | x11r6 | 4.2.0 | |
| xfree86_project | x11r6 | 4.2.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F33E5444-E178-4F49-BDA1-DE576D8526EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1BCC09AA-AB01-4583-8052-66DBF0E1861D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "43425C85-806B-4823-AD74-D0A0465FC8DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90FA67D9-8296-4534-8354-51B830DE3499",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4AC4F566-5D54-4364-B5AA-F846A0C8FCEB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7F9D1BD9-4300-43B5-A87B-E2BF74E55C87",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands."
},
{
"lang": "es",
"value": "El emulador de terminal xterm en XFree86 4.2.0 permite a atacantes modificar el t\u00edtulo de la ventana mediante cierta secuencia de caracter de escape y a continuaci\u00f3n insertarlo de vuelta en la linea de comando en el terminal del usuario, por ejemplo, cuando el usuario ve un fichero que contiene la secuencia maliciosa, lo que podr\u00eda permitir ejecutar comandos arbitrarios."
}
],
"id": "CVE-2003-0063",
"lastModified": "2025-04-03T01:03:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.4,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2003-03-03T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2024/06/15/1"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/6940"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2024/06/15/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/6940"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CERTA-2009-AVI-002
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été identifiée dans l'émulateur de terminal standard xterm sous Debian. Elle permet à une personne malveillante distante d'exécuter du code arbitraire sur le poste ayant une version vulnérable.
Description
Une vulnérabilité a été identifiée dans l'émulateur de terminal standard xterm sous Debian. L'interprétation de certains noms de commande n'est pas correctement effectuée dans une DECRQSS (Device Control Request Status String). Cela permettrait à une personne malveillante distante d'exécuter des commandes arbitraires.
Cette vulnérabilité est à mettre en relation avec des corrections apportées en 2003 et 2006 à l'application.
Solution
Se référer aux bulletins de sécurité des éditeurs pour l'obtention des correctifs (cf. section Documentation).
Les versions de xterm antérieures à 238-1 sous Debian.
Impacted products
| Vendor | Product | Description |
|---|
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cP\u003eLes versions de \u003cTT\u003exterm\u003c/TT\u003e ant\u00e9rieures \u00e0 238-1 sous Debian.\u003c/P\u003e",
"content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans l\u0027\u00e9mulateur de terminal standard\nxterm sous Debian. L\u0027interpr\u00e9tation de certains noms de commande n\u0027est\npas correctement effectu\u00e9e dans une DECRQSS (Device Control Request\nStatus String). Cela permettrait \u00e0 une personne malveillante distante\nd\u0027ex\u00e9cuter des commandes arbitraires.\n\nCette vuln\u00e9rabilit\u00e9 est \u00e0 mettre en relation avec des corrections\napport\u00e9es en 2003 et 2006 \u00e0 l\u0027application.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"name": "CVE-2006-7236",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-7236"
},
{
"name": "CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"name": "CVE-2008-2383",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2383"
}
],
"links": [
{
"title": "Rapport de bogue Debian 384593 du 25 ao\u00fbt 2006\u00a0:",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593"
},
{
"title": "Avis CERTA-2003-AVI-067 du 28 mars 2003\u00a0:",
"url": "http://www.certa.ssi.gouv.fr/site/CERTA-2003-AVI-067/"
}
],
"reference": "CERTA-2009-AVI-002",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-01-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans l\u0027\u00e9mulateur de terminal standard\nxterm sous Debian. Elle permet \u00e0 une personne malveillante distante\nd\u0027ex\u00e9cuter du code arbitraire sur le poste ayant une version vuln\u00e9rable.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans xterm",
"vendor_advisories": [
{
"published_at": null,
"title": "Rapport de bogue Debian 510030",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030"
}
]
}
CERTA-2010-AVI-143
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Mac OS X.
Description
Plusieurs vulnérabilités ont été corrigées dans Mac OS X. Elles permettent entre autres l'exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mac OS X 10.5 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X 10.6 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X Server 10.5 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X Server 10.6.",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Mac OS X. Elles\npermettent entre autres l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2010-0511",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0511"
},
{
"name": "CVE-2010-0509",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0509"
},
{
"name": "CVE-2010-0501",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0501"
},
{
"name": "CVE-2010-0065",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0065"
},
{
"name": "CVE-2010-0498",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0498"
},
{
"name": "CVE-2010-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0060"
},
{
"name": "CVE-2008-7247",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-7247"
},
{
"name": "CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"name": "CVE-2010-0043",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0043"
},
{
"name": "CVE-2010-0522",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0522"
},
{
"name": "CVE-2010-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0063"
},
{
"name": "CVE-2009-3559",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3559"
},
{
"name": "CVE-2009-2901",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2901"
},
{
"name": "CVE-2009-4142",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4142"
},
{
"name": "CVE-2009-3009",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3009"
},
{
"name": "CVE-2010-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0059"
},
{
"name": "CVE-2010-0524",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0524"
},
{
"name": "CVE-2010-0057",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0057"
},
{
"name": "CVE-2009-2693",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2693"
},
{
"name": "CVE-2010-0521",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0521"
},
{
"name": "CVE-2008-0564",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0564"
},
{
"name": "CVE-2010-0518",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0518"
},
{
"name": "CVE-2010-0513",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0513"
},
{
"name": "CVE-2009-2417",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2417"
},
{
"name": "CVE-2008-0888",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0888"
},
{
"name": "CVE-2009-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3558"
},
{
"name": "CVE-2009-3095",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3095"
},
{
"name": "CVE-2009-2902",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2902"
},
{
"name": "CVE-2010-0517",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0517"
},
{
"name": "CVE-2010-0535",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0535"
},
{
"name": "CVE-2010-0393",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0393"
},
{
"name": "CVE-2009-3557",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3557"
},
{
"name": "CVE-2009-0580",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0580"
},
{
"name": "CVE-2010-0042",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0042"
},
{
"name": "CVE-2010-0534",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0534"
},
{
"name": "CVE-2010-0497",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0497"
},
{
"name": "CVE-2008-4456",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4456"
},
{
"name": "CVE-2009-4143",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4143"
},
{
"name": "CVE-2010-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0058"
},
{
"name": "CVE-2010-0041",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0041"
},
{
"name": "CVE-2010-0508",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0508"
},
{
"name": "CVE-2010-0506",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0506"
},
{
"name": "CVE-2010-0533",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0533"
},
{
"name": "CVE-2010-0507",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0507"
},
{
"name": "CVE-2010-0504",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0504"
},
{
"name": "CVE-2009-0316",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0316"
},
{
"name": "CVE-2010-0526",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0526"
},
{
"name": "CVE-2010-0510",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0510"
},
{
"name": "CVE-2009-1904",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1904"
},
{
"name": "CVE-2010-0500",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0500"
},
{
"name": "CVE-2008-5302",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5302"
},
{
"name": "CVE-2009-2042",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2042"
},
{
"name": "CVE-2010-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0064"
},
{
"name": "CVE-2009-0033",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0033"
},
{
"name": "CVE-2009-2446",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2446"
},
{
"name": "CVE-2009-2801",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2801"
},
{
"name": "CVE-2010-0525",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0525"
},
{
"name": "CVE-2010-0516",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0516"
},
{
"name": "CVE-2010-0502",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0502"
},
{
"name": "CVE-2010-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0062"
},
{
"name": "CVE-2008-2712",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2712"
},
{
"name": "CVE-2009-2906",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2906"
},
{
"name": "CVE-2010-0505",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0505"
},
{
"name": "CVE-2008-5303",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5303"
},
{
"name": "CVE-2009-0781",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0781"
},
{
"name": "CVE-2009-4214",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4214"
},
{
"name": "CVE-2009-0783",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0783"
},
{
"name": "CVE-2009-0689",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0689"
},
{
"name": "CVE-2008-5515",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5515"
},
{
"name": "CVE-2006-1329",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-1329"
},
{
"name": "CVE-2010-0514",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0514"
},
{
"name": "CVE-2009-0037",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0037"
},
{
"name": "CVE-2010-0515",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0515"
},
{
"name": "CVE-2009-2422",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2422"
},
{
"name": "CVE-2010-0056",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0056"
},
{
"name": "CVE-2010-0512",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0512"
},
{
"name": "CVE-2009-2632",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2632"
},
{
"name": "CVE-2009-0688",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0688"
},
{
"name": "CVE-2008-4101",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4101"
},
{
"name": "CVE-2010-0537",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0537"
},
{
"name": "CVE-2010-0519",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0519"
},
{
"name": "CVE-2010-0523",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0523"
},
{
"name": "CVE-2010-0520",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0520"
},
{
"name": "CVE-2010-0503",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0503"
},
{
"name": "CVE-2010-0055",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0055"
}
],
"links": [],
"reference": "CERTA-2010-AVI-143",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2010-03-30T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Mac OS X.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple MacOS X",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT4077 du 29 mars 2010",
"url": "http://support.apple.com/kb/HT4077"
}
]
}
CERTA-2010-AVI-143
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans Mac OS X.
Description
Plusieurs vulnérabilités ont été corrigées dans Mac OS X. Elles permettent entre autres l'exécution de code arbitraire à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Mac OS X 10.5 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X 10.6 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X Server 10.5 ;",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "Mac OS X Server 10.6.",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Mac OS X. Elles\npermettent entre autres l\u0027ex\u00e9cution de code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2010-0511",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0511"
},
{
"name": "CVE-2010-0509",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0509"
},
{
"name": "CVE-2010-0501",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0501"
},
{
"name": "CVE-2010-0065",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0065"
},
{
"name": "CVE-2010-0498",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0498"
},
{
"name": "CVE-2010-0060",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0060"
},
{
"name": "CVE-2008-7247",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-7247"
},
{
"name": "CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"name": "CVE-2010-0043",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0043"
},
{
"name": "CVE-2010-0522",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0522"
},
{
"name": "CVE-2010-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0063"
},
{
"name": "CVE-2009-3559",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3559"
},
{
"name": "CVE-2009-2901",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2901"
},
{
"name": "CVE-2009-4142",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4142"
},
{
"name": "CVE-2009-3009",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3009"
},
{
"name": "CVE-2010-0059",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0059"
},
{
"name": "CVE-2010-0524",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0524"
},
{
"name": "CVE-2010-0057",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0057"
},
{
"name": "CVE-2009-2693",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2693"
},
{
"name": "CVE-2010-0521",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0521"
},
{
"name": "CVE-2008-0564",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0564"
},
{
"name": "CVE-2010-0518",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0518"
},
{
"name": "CVE-2010-0513",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0513"
},
{
"name": "CVE-2009-2417",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2417"
},
{
"name": "CVE-2008-0888",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-0888"
},
{
"name": "CVE-2009-3558",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3558"
},
{
"name": "CVE-2009-3095",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3095"
},
{
"name": "CVE-2009-2902",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2902"
},
{
"name": "CVE-2010-0517",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0517"
},
{
"name": "CVE-2010-0535",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0535"
},
{
"name": "CVE-2010-0393",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0393"
},
{
"name": "CVE-2009-3557",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-3557"
},
{
"name": "CVE-2009-0580",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0580"
},
{
"name": "CVE-2010-0042",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0042"
},
{
"name": "CVE-2010-0534",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0534"
},
{
"name": "CVE-2010-0497",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0497"
},
{
"name": "CVE-2008-4456",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4456"
},
{
"name": "CVE-2009-4143",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4143"
},
{
"name": "CVE-2010-0058",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0058"
},
{
"name": "CVE-2010-0041",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0041"
},
{
"name": "CVE-2010-0508",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0508"
},
{
"name": "CVE-2010-0506",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0506"
},
{
"name": "CVE-2010-0533",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0533"
},
{
"name": "CVE-2010-0507",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0507"
},
{
"name": "CVE-2010-0504",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0504"
},
{
"name": "CVE-2009-0316",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0316"
},
{
"name": "CVE-2010-0526",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0526"
},
{
"name": "CVE-2010-0510",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0510"
},
{
"name": "CVE-2009-1904",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-1904"
},
{
"name": "CVE-2010-0500",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0500"
},
{
"name": "CVE-2008-5302",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5302"
},
{
"name": "CVE-2009-2042",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2042"
},
{
"name": "CVE-2010-0064",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0064"
},
{
"name": "CVE-2009-0033",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0033"
},
{
"name": "CVE-2009-2446",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2446"
},
{
"name": "CVE-2009-2801",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2801"
},
{
"name": "CVE-2010-0525",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0525"
},
{
"name": "CVE-2010-0516",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0516"
},
{
"name": "CVE-2010-0502",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0502"
},
{
"name": "CVE-2010-0062",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0062"
},
{
"name": "CVE-2008-2712",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2712"
},
{
"name": "CVE-2009-2906",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2906"
},
{
"name": "CVE-2010-0505",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0505"
},
{
"name": "CVE-2008-5303",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5303"
},
{
"name": "CVE-2009-0781",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0781"
},
{
"name": "CVE-2009-4214",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-4214"
},
{
"name": "CVE-2009-0783",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0783"
},
{
"name": "CVE-2009-0689",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0689"
},
{
"name": "CVE-2008-5515",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-5515"
},
{
"name": "CVE-2006-1329",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-1329"
},
{
"name": "CVE-2010-0514",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0514"
},
{
"name": "CVE-2009-0037",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0037"
},
{
"name": "CVE-2010-0515",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0515"
},
{
"name": "CVE-2009-2422",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2422"
},
{
"name": "CVE-2010-0056",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0056"
},
{
"name": "CVE-2010-0512",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0512"
},
{
"name": "CVE-2009-2632",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-2632"
},
{
"name": "CVE-2009-0688",
"url": "https://www.cve.org/CVERecord?id=CVE-2009-0688"
},
{
"name": "CVE-2008-4101",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-4101"
},
{
"name": "CVE-2010-0537",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0537"
},
{
"name": "CVE-2010-0519",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0519"
},
{
"name": "CVE-2010-0523",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0523"
},
{
"name": "CVE-2010-0520",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0520"
},
{
"name": "CVE-2010-0503",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0503"
},
{
"name": "CVE-2010-0055",
"url": "https://www.cve.org/CVERecord?id=CVE-2010-0055"
}
],
"links": [],
"reference": "CERTA-2010-AVI-143",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2010-03-30T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Injection de code indirecte \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans Mac OS X.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple MacOS X",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT4077 du 29 mars 2010",
"url": "http://support.apple.com/kb/HT4077"
}
]
}
CERTA-2009-AVI-002
Vulnerability from certfr_avis - Published: - Updated:
Une vulnérabilité a été identifiée dans l'émulateur de terminal standard xterm sous Debian. Elle permet à une personne malveillante distante d'exécuter du code arbitraire sur le poste ayant une version vulnérable.
Description
Une vulnérabilité a été identifiée dans l'émulateur de terminal standard xterm sous Debian. L'interprétation de certains noms de commande n'est pas correctement effectuée dans une DECRQSS (Device Control Request Status String). Cela permettrait à une personne malveillante distante d'exécuter des commandes arbitraires.
Cette vulnérabilité est à mettre en relation avec des corrections apportées en 2003 et 2006 à l'application.
Solution
Se référer aux bulletins de sécurité des éditeurs pour l'obtention des correctifs (cf. section Documentation).
Les versions de xterm antérieures à 238-1 sous Debian.
Impacted products
| Vendor | Product | Description |
|---|
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [],
"affected_systems_content": "\u003cP\u003eLes versions de \u003cTT\u003exterm\u003c/TT\u003e ant\u00e9rieures \u00e0 238-1 sous Debian.\u003c/P\u003e",
"content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans l\u0027\u00e9mulateur de terminal standard\nxterm sous Debian. L\u0027interpr\u00e9tation de certains noms de commande n\u0027est\npas correctement effectu\u00e9e dans une DECRQSS (Device Control Request\nStatus String). Cela permettrait \u00e0 une personne malveillante distante\nd\u0027ex\u00e9cuter des commandes arbitraires.\n\nCette vuln\u00e9rabilit\u00e9 est \u00e0 mettre en relation avec des corrections\napport\u00e9es en 2003 et 2006 \u00e0 l\u0027application.\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 des \u00e9diteurs pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2003-0063",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0063"
},
{
"name": "CVE-2006-7236",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-7236"
},
{
"name": "CVE-2003-0071",
"url": "https://www.cve.org/CVERecord?id=CVE-2003-0071"
},
{
"name": "CVE-2008-2383",
"url": "https://www.cve.org/CVERecord?id=CVE-2008-2383"
}
],
"links": [
{
"title": "Rapport de bogue Debian 384593 du 25 ao\u00fbt 2006\u00a0:",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=384593"
},
{
"title": "Avis CERTA-2003-AVI-067 du 28 mars 2003\u00a0:",
"url": "http://www.certa.ssi.gouv.fr/site/CERTA-2003-AVI-067/"
}
],
"reference": "CERTA-2009-AVI-002",
"revisions": [
{
"description": "version initiale.",
"revision_date": "2009-01-05T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
}
],
"summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 identifi\u00e9e dans l\u0027\u00e9mulateur de terminal standard\nxterm sous Debian. Elle permet \u00e0 une personne malveillante distante\nd\u0027ex\u00e9cuter du code arbitraire sur le poste ayant une version vuln\u00e9rable.\n",
"title": "Vuln\u00e9rabilit\u00e9 dans xterm",
"vendor_advisories": [
{
"published_at": null,
"title": "Rapport de bogue Debian 510030",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030"
}
]
}
GHSA-4F3F-7MF9-QRHC
Vulnerability from github – Published: 2022-04-29 01:25 – Updated: 2024-08-22 18:31
VLAI?
Details
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Severity ?
7.3 (High)
{
"affected": [],
"aliases": [
"CVE-2003-0063"
],
"database_specific": {
"cwe_ids": [
"CWE-150"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-03-03T05:00:00Z",
"severity": "HIGH"
},
"details": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"id": "GHSA-4f3f-7mf9-qrhc",
"modified": "2024-08-22T18:31:18Z",
"published": "2022-04-29T01:25:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0063"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"type": "WEB",
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/06/15/1"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/6940"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GSD-2003-0063
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2003-0063",
"description": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"id": "GSD-2003-0063",
"references": [
"https://www.suse.com/security/cve/CVE-2003-0063.html",
"https://www.debian.org/security/2003/dsa-380",
"https://access.redhat.com/errata/RHSA-2003:067",
"https://access.redhat.com/errata/RHSA-2003:066",
"https://access.redhat.com/errata/RHSA-2003:065",
"https://access.redhat.com/errata/RHSA-2003:064"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2003-0063"
],
"details": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.",
"id": "GSD-2003-0063",
"modified": "2023-12-13T01:22:13.470800Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0063",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-380",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"name": "RHSA-2003:067",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"name": "RHSA-2003:066",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
},
{
"name": "RHSA-2003:064",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"name": "RHSA-2003:065",
"refsource": "REDHAT",
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"name": "6940",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/6940"
},
{
"name": "terminal-emulator-window-title(11414)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"refsource": "VULNWATCH",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:xfree86_project:x11r6:4.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0063"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The xterm terminal emulator in XFree86 4.2.0 and earlier allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user\u0027s terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20030224 Terminal Emulator Security Issues",
"refsource": "VULNWATCH",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0093.html"
},
{
"name": "terminal-emulator-window-title(11414)",
"refsource": "XF",
"tags": [
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/11414.php"
},
{
"name": "DSA-380",
"refsource": "DEBIAN",
"tags": [],
"url": "http://www.debian.org/security/2003/dsa-380"
},
{
"name": "RHSA-2003:064",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2003-064.html"
},
{
"name": "RHSA-2003:065",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2003-065.html"
},
{
"name": "RHSA-2003:066",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2003-066.html"
},
{
"name": "RHSA-2003:067",
"refsource": "REDHAT",
"tags": [],
"url": "http://www.redhat.com/support/errata/RHSA-2003-067.html"
},
{
"name": "6940",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/6940"
},
{
"name": "20030224 Terminal Emulator Security Issues",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://marc.info/?l=bugtraq\u0026m=104612710031920\u0026w=2"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2016-10-18T02:28Z",
"publishedDate": "2003-03-03T05:00Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…