Input validation error in Rxvt - CVE-2000-0476

Vulnerability identifier: #VU94647

CSH Severity: Low

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2000-0476

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to insert certain characters that force the window to be resized and crash the terminal.

Rxvt
openEuler
Anolis OS
vte291
vte291-debuginfo
vte291-debugsource
vte291-devel
vte-profile
vte291-gtk4
vte291-gtk4-devel

Install updates from vendor's website.

Rxvt - update to 2.6.2
vte291 - addressed in versions 0.54.1-6, 0.62.3-2
vte291-debuginfo - addressed in versions 0.54.1-6, 0.62.3-2
vte291-debugsource - addressed in versions 0.54.1-6, 0.62.3-2
vte291-devel - addressed in versions 0.54.1-6, 0.62.3-2
vte-profile - update to 0.74.0-3
vte291 - update to 0.74.0-3
vte291-devel - update to 0.74.0-3
vte291-gtk4 - update to 0.74.0-3
vte291-gtk4-devel - update to 0.74.0-3

• Exploit #10238 - Eterm 0.8.10 / rxvt 2.6.1 / PuTTY 0.48 / X11R6 3.3.3/4.0 - Denial of Service (July 23, 2024)

• http://archives.neohapsis.com/archives/bugtraq/2000-05/0409.html
• http://www.securityfocus.com/bid/1298
• http://archives.neohapsis.com/archives/bugtraq/2000-05/0420.html
• http://www.openwall.com/lists/oss-security/2024/06/09/1
• http://www.openwall.com/lists/oss-security/2024/06/09/2

• Denial of service in Rxvt
• openEuler 22.03 LTS SP3 update for vte291
• openEuler 20.03 LTS SP4 update for vte291
• openEuler 22.03 LTS SP4 update for vte291
• openEuler 22.03 LTS SP1 update for vte291
• Anolis OS update for vte291