GCVE - cpe:2.3:a:invisible-island:xterm:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:invisible-island:xterm:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Invisible Island (`80f27a31-63fb-5046-9fd5-fe1742cde49b`)
Product	Xterm (`ff9a53a2-8517-5a6d-9ac5-7cb3d931ef7e`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/xterm`	purl2cpe	2026-06-01 10:15:30.114231
`pkg:deb/ubuntu/xterm`	purl2cpe	2026-06-01 10:15:30.114233
`pkg:github/hamishcoleman/xterm`	purl2cpe	2026-06-01 10:15:30.114235
`pkg:gitlab/redhat/xterm`	purl2cpe	2026-06-01 10:15:30.114236
`pkg:rpm/centos/xterm`	purl2cpe	2026-06-01 10:15:30.114238
`pkg:rpm/fedora/xterm`	purl2cpe	2026-06-01 10:15:30.114239
`pkg:rpm/opensuse/xterm`	purl2cpe	2026-06-01 10:15:30.114241

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-40359`	vulnerable	2026-06-08 06:09:42.153422	Details available xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature. Published: 2023-08-14T00:00:00.000Z Updated: 2024-10-09T14:50:22.239Z Open on db.gcve.eu Reference links https://invisible-island.net/xterm/xterm.log.html#xterm_380	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-45063`	vulnerable	2026-06-08 05:50:35.546209	Details available xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions. Published: 2022-11-10T00:00:00.000Z Updated: 2026-04-08T17:24:10.360Z Open on db.gcve.eu Reference links https://invisible-island.net/xterm/xterm.log.html https://www.openwall.com/lists/oss-security/2022/11/10/1 https://news.ycombinator.com/item?id=33546415 http://www.openwall.com/lists/oss-security/2022/11/10/1 http://www.openwall.com/lists/oss-security/2022/11/10/5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-24130`	vulnerable	2026-06-08 05:40:59.685697	Details available xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. Published: 2022-01-31T05:01:06.000Z Updated: 2024-08-03T03:59:23.628Z Open on db.gcve.eu Reference links https://twitter.com/nickblack/status/1487731459398025216 https://www.openwall.com/lists/oss-security/2022/01/30/2 https://www.openwall.com/lists/oss-security/2022/01/30/3 https://invisible-island.net/xterm/xterm.log.html https://lists.debian.org/debian-lts-announce/2022/02/msg00007.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-27135`	vulnerable	2026-06-08 05:30:45.993414	Details available xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence. Published: 2021-02-10T15:51:16.000Z Updated: 2024-08-03T20:40:47.383Z Open on db.gcve.eu Reference links https://www.openwall.com/lists/oss-security/2021/02/09/7 https://www.openwall.com/lists/oss-security/2021/02/09/9 http://www.openwall.com/lists/oss-security/2021/02/10/7 https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.