CVE-2021-33477
Fixed in a distro release EPSS 4%
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
Products: eterm_project eterm, mrxvt_project mrxvt, rxvt-unicode_project rxvt-unicode, rxvt_project rxvt, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | mrxvt | 0.5.4-r8 |
| Alpine 3.10 | rxvt-unicode | 9.22-r7 |
| Alpine 3.11 | mrxvt | 0.5.4-r8 |
| Alpine 3.11 | rxvt-unicode | 9.22-r8 |
| Debian 12 | eterm | 0.9.6-6.1 |
| Debian 12 | rxvt-unicode | 9.22-11 |
| Debian 13 | rxvt-unicode | 9.22-11 |
| Debian 14 | eterm | 0.9.6-6.1 |
| Debian 14 | rxvt-unicode | 9.22-11 |
| Debian 9 | eterm | 0.9.6-5+deb9u1 |
| Debian 9 | mrxvt | 0.5.4-2+deb9u1 |
| Debian 9 | rxvt | 1:2.7.10-7+deb9u2 |
| Debian 9 | rxvt-unicode | 9.22-1+deb9u1 |
| SUSE Package Hub 15 SP3 | rxvt-unicode | 9.26-bp154.2.3.1 |
| SUSE Package Hub 15 SP4 | rxvt-unicode | 9.26-bp154.2.3.1 |
| Ubuntu 16.04 LTS | eterm | no fix |
| Ubuntu 16.04 LTS | mrxvt | no fix |
| Ubuntu 16.04 LTS | rxvt | no fix |
| Ubuntu 16.04 LTS | rxvt-unicode | no fix |
| Ubuntu 18.04 LTS | eterm | no fix |
| Ubuntu 18.04 LTS | rxvt-unicode | no fix |
| Ubuntu 20.04 LTS | eterm | no fix |
| Ubuntu 20.04 LTS | rxvt-unicode | no fix |
| openSUSE Leap 15.3 | rxvt-unicode | 9.26-bp154.2.3.1 |
| openSUSE Leap 15.4 | rxvt-unicode | 9.26-bp154.2.3.1 |
| openSUSE Tumbleweed | rxvt-unicode | 9.30-2.1 |