OS Command Injection in xterm - CVE-2022-45063

Detailed vulnerability description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing font ops. A remote attacker can trick the victim into opening a specially crafted file and execute arbitrary OS commands on the target system within the vi line-editing mode of Zsh.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

How to mitigate CVE-2022-45063

Sources

• https://invisible-island.net/xterm/xterm.log.html
• https://www.openwall.com/lists/oss-security/2022/11/10/1
• https://news.ycombinator.com/item?id=33546415
• http://www.openwall.com/lists/oss-security/2022/11/10/1
• http://www.openwall.com/lists/oss-security/2022/11/10/5