CVE Feed

    Dashboard / CVE / CVE-2008-2383

    CVE-2008-2383

    CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

    Published:Dec 29, 2008
    Last Modified:Apr 23, 2026
    EPS:Jan 2, 2009
    EPSS Score:0.01716
    CVSS Score:9.3

    Affected Products

    Vendor
    Invisible-island
    Product
    Xterm
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    References

    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
    http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
    http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
    http://secunia.com/advisories/33318
    http://secunia.com/advisories/33388
    http://secunia.com/advisories/33397
    http://secunia.com/advisories/33418
    http://secunia.com/advisories/33419
    http://secunia.com/advisories/33568
    http://secunia.com/advisories/33820
    http://secunia.com/advisories/35074
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-254208-1
    http://support.apple.com/kb/HT3549
    http://www.debian.org/security/2009/dsa-1694
    http://www.redhat.com/support/errata/RHSA-2009-0018.html
    http://www.redhat.com/support/errata/RHSA-2009-0019.html
    http://www.securityfocus.com/bid/33060
    http://www.securitytracker.com/id?1021522
    http://www.us-cert.gov/cas/techalerts/TA09-133A.html
    http://www.vupen.com/english/advisories/2009/1297
    https://exchange.xforce.ibmcloud.com/vulnerabilities/47655
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3E2Q6NPKT7V4VKZMSFF4ARLRVYOG4AU/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOOVZTIABA4MIFUGTAVYWO6QXSUXSST4/
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9317
    https://usn.ubuntu.com/703-1/
    https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00072.html
    https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00184.html
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
    http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2009-01/msg00004.html
    http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html
    http://secunia.com/advisories/33318
    http://secunia.com/advisories/33388
    http://secunia.com/advisories/33397
    http://secunia.com/advisories/33418
    http://secunia.com/advisories/33419
    http://secunia.com/advisories/33568
    http://secunia.com/advisories/33820
    http://secunia.com/advisories/35074
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-254208-1
    http://support.apple.com/kb/HT3549
    http://www.debian.org/security/2009/dsa-1694
    http://www.redhat.com/support/errata/RHSA-2009-0018.html
    http://www.redhat.com/support/errata/RHSA-2009-0019.html
    http://www.securityfocus.com/bid/33060
    http://www.securitytracker.com/id?1021522
    http://www.us-cert.gov/cas/techalerts/TA09-133A.html
    http://www.vupen.com/english/advisories/2009/1297
    https://exchange.xforce.ibmcloud.com/vulnerabilities/47655
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R3E2Q6NPKT7V4VKZMSFF4ARLRVYOG4AU/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOOVZTIABA4MIFUGTAVYWO6QXSUXSST4/
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9317
    https://usn.ubuntu.com/703-1/
    https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00072.html
    https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00184.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High