1. Ubuntu Security Notices
  2. USN-962-1

USN-962-1: VTE vulnerability

Publication date

15 July 2010

Overview

arbitrary command execution via terminal escape codes

Releases

Packages

  • vte - Terminal emulator widget for GTK+ 2.0

Details

Janne Snabb discovered that applications using VTE, such as gnome-terminal,
did not correctly filter window and icon title request escape codes. If a
user were tricked into viewing specially crafted output in their terminal,
a remote attacker could execute arbitrary commands with user privileges.

Janne Snabb discovered that applications using VTE, such as gnome-terminal,
did not correctly filter window and icon title request escape codes. If a
user were tricked into viewing specially crafted output in their terminal,
a remote attacker could execute arbitrary commands with user privileges.

Update instructions

After a standard system update you need to restart your session to make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic libvte9 –  1:0.22.2-0ubuntu2.1
9.04 jaunty libvte9 –  1:0.20.0-0ubuntu2.1
10.04 lucid libvte9 –  1:0.23.5-0ubuntu1.1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›