CVE-1999-1210
HighExploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
xterm in Digital UNIX 4.0B with patch kit 5 allows local users to overwrite arbitrary files via a symlink attack on a core dump file, which is created when xterm is called with a DISPLAY environmental variable set to a display that xterm cannot access.
Risk Assessment
An attacker could exploit this vulnerability to overwrite critical system files, potentially leading to data loss or system instability.
Recommendation
It is recommended to update to the latest version of xterm and restrict access to the DISPLAY variable for local users.
Other vulnerabilities in xterm
See all- CVE-2023-40359Critical
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), leading to a pointer/overflow issue. This can only occur for xterm installations configured at compile time to use a certain experimental feature.
- CVE-1999-0965Medium
Race condition in xterm allows local users to modify arbitrary files via the logging option.
Original NVD description (English source)
xterm in Digital UNIX 4.0B *with* patch kit 5 allows local users to overwrite arbitrary files via a symlink attack on a core dump file, which is created when xterm is called with a DISPLAY environmental variable set to a display that xterm cannot access.