CVE-2006-7236
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the...
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Exploit likelihood
What each source reports
NVD Score used
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
CVE-2006-7236- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
CVE-2006-7236- Updated
- 2026-11-02
EUVDEUVD-2006-7213 No score
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
EUVD-2006-7213- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9r87-p9p6-pqp9 No score
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the...
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
GHSA-9r87-p9p6-pqp9- Updated
- 2026-11-02
OSV No score
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
CVE-2006-7236- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-7236 No score
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
- Record
DEBIAN-CVE-2006-7236- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | xterm - DECRQSS Remote Command Execution | 2008-12-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-7236 is a high vulnerability (CVSS 9.3) in Invisible-island Xterm, published January 2, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.47%, the 94th percentile. Fixed in xterm 238-1.