USN-703-1: xterm vulnerabilities

Releases

• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 7.10
• Ubuntu 6.06

Packages

• xterm -

Details

Paul Szabo discovered that the DECRQSS escape sequences were not handled
correctly by xterm. Additionally, window title operations were also not
safely handled. If a user were tricked into viewing a specially crafted
series of characters while in xterm, a remote attacker could execute
arbitrary commands with user privileges. (CVE-2006-7236, CVE-2008-2382)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 8.10

• xterm - 235-1ubuntu1.1

Ubuntu 8.04

• xterm - 229-1ubuntu1.1

Ubuntu 7.10

• xterm - 229-1ubuntu0.1

Ubuntu 6.06

• xterm - 208-3.1ubuntu3.1

After a standard system upgrade you need to restart any running xterms to
effect the necessary changes.

References

• CVE-2008-2383
• CVE-2006-7236