News for hackers. Stuff that matters.

A comment on CVE-2021-27135: xterm flaw may allow remote code execution, CVSS 9.6. Parent comment

Re:CVE-2021-27135: xterm flaw may allow remote code executio... by kstrauser on Saturday March 20, 2021 @02:51PM (#26525165)
I haven’t seen that yet. Do you have a link saying that you have to select text? That would help a lot in the mean time if true.
[ Parent | on HN ]
Re:CVE-2021-27135: xterm flaw may allow remote code executio... by JoshTriplett on Saturday March 20, 2021 @03:03PM (#26525271)
See https://www.openwall.com/lists/oss-security/2021/02/09/7 :

> To reproduce in XTerm, decode the file then try to select the line.

For the original report on screen, see https://lists.gnu.org/archive/html/screen-devel/2021-02/msg0... (warning, contains the raw test case, may crash a text-based browser).

[ Parent | on HN ]
Re:CVE-2021-27135: xterm flaw may allow remote code executio... by craig131 on Saturday March 20, 2021 @03:17PM (#26525368)
https://invisible-island.net/xterm/xterm.log.html#xterm_366

Specifically, the overflow is in the upper limit of the text selection buffer when characters are combined in UTF-8.

[ Parent | on HN ]