CVE-2023-40359
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), leading to a pointer/overflow issue. This can only occur for xterm installations configured at compile time to use a certain experimental feature.
Risk Assessment
Organizations may be exposed to attacks exploiting pointer overflow, potentially leading to unauthorized access or system instability. This specifically affects xterm installations with the experimental feature enabled.
Recommendation
It is recommended to update xterm to version 380 or later to mitigate this vulnerability. Additionally, avoid enabling experimental features that may introduce risks.
Original NVD description (English source)
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.