{"id":"CVE-2008-1142","aliases":["EUVD-2008-1151","GHSA-2cjq-7pqj-grxv","openSUSE-SU-2022:10222-1","openSUSE-SU-2024:10526-1"],"status":"published","title":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which...","description":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.","severity":{"version":"2.0","score":3.7,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00363,"percentile":0.3039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2008-04-07T17:00:00Z","modified":"2026-06-16T22:51:04Z","affected":[{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-1.1"}]}],"bundled":2}],"products":[{"vendor":"aterm","product":"aterm"},{"vendor":"eterm","product":"eterm"},{"vendor":"mrxvt","product":"mrxvt"},{"vendor":"multi-aterm","product":"multi-aterm"},{"vendor":"rxvt","product":"rxvt"},{"vendor":"rxvt-unicode","product":"rxvt-unicode"},{"vendor":"wterm","product":"wterm"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://article.gmane.org/gmane.comp.security.oss.general/122","tags":["x_refsource_MISC","x_transferred"]},{"url":"http://secunia.com/advisories/30226","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/28512","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"http://secunia.com/advisories/30229","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/31687","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/30225","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://secunia.com/advisories/30227","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://security.gentoo.org/glsa/glsa-200805-03.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://secunia.com/advisories/30224","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:161","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:221","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://secunia.com/advisories/29576","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1142"},{"url":"https://github.com/advisories/GHSA-2cjq-7pqj-grxv"},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YIRRHCE53YNBLDGNULGNED3XGUMUZDMO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186174","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33477","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3121","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2008-1142","description":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.","status":"published","published":"2008-04-07T17:00:00Z","modified":"2024-08-07T08:08:57.701Z","updated_at":"2026-11-02T14:34:48.103804Z"}],"euvd":[{"id":"EUVD-2008-1151","description":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.","status":"published","published":"2008-04-07T17:00:00Z","modified":"2024-08-07T08:08:57Z","updated_at":"2026-11-03T01:39:03.090998Z"}],"ghsa":[{"id":"GHSA-2cjq-7pqj-grxv","title":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which...","description":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.","status":"published","published":"2022-05-01T23:36:54Z","modified":"2023-01-31T05:05:23Z","updated_at":"2026-11-02T14:48:50.52088Z"}],"nvd":[{"id":"CVE-2008-1142","description":"rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections.  NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected.  NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.","status":"published","published":"2008-04-07T17:44:00Z","modified":"2026-06-16T22:51:04.81Z","cvss":[{"version":"2.0","score":3.7,"vector":"AV:L/AC:H/Au:N/C:P/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:01:25.857543Z"}],"osv":[{"id":"openSUSE-SU-2022:10222-1","title":"Security update for rxvt-unicode","description":"This update for rxvt-unicode fixes the following issues:\n\nUpdate to 9.26\n\n- ev_iouring.c was wrongly required during compilation, and wrongly\n  not packaged.\n\nUpdate to 9.25 (boo#1186174 CVE-2021-33477)\n\n- for the 17.5th anniversary, and because many distributions seem to\n  remove rxvt in favour of urxvt, this release resurrects rclock as\n  urclock.\n- add support for systemd socket-based activation - debian bug #917105,\n  freebsd bug #234276.\n- do not destruct perl on exit anymore: this might fail for a variety of\n  reasons, and takes unneccessary time.\n- remove any macros from urxvtperl manpage(s), should fix debian\n  bug 858385.\n- the old bg image resources are now provided by the background\n  extension, and perl is thus required for bg image support. No\n  configuration change is needed: urxvt autoloads the background\n  ext if any bg image resource/option is present (for OSC sequences to\n  work you need to enable it explicity). The old bg image\n  resources are also now deprecated; users are encouraged to\n  switch to the new bg image interface (see man urxvt-background).\n- confirm-paste now checks for any ctlchars, not just newlines.\n- searchable scrollback will now ignore bracketed paste mode sequences\n  (prompted by Daniel Gröber's patch).\n- drop ISO 2022 locale support. ISO 2022 encodings are not supported in\n  POSIX locales and clash with vt100 charset emulation (the luit\n  program can be used as a substitute).\n- perl didn't parse rgba colours specified as an array correctly,\n  only allowing 0 and 100% intensity for each component (this affected\n  fill and tint).\n- when iterating over resources, urxvt will now try to properly handle\n  multipart resources (such as '*background.expr'), for the benefit\n  of autoloading perl extensions.\n- ESC G (query rxvt graphics mode) has been disabled due to security\n  implications. The rxvt graphics mode was removed in rxvt-unicode 1.5,\n  and no programs relying on being able to query the mode are known.\n- work around API change breakage in perl 5.28, based on a patch by\n  Roman Bogorodskiy.\n- improved security: rob nation's (obsolete) graphics mode queries\n  no longer reply with linefeed in secure/default mode.\n- ISO 8613-3 direct colour SGR sequences (patch by Fengguang Wu).\n- xterm focus reporting mode (patch by Daniel Hahler).\n- xterm SGR mouse mode.\n- implement DECRQM. Patch by Přemysl Eric Janouch.\n- add missing color index parameter to OSC 4 response. Patch\n  by Přemysl Eric Janouch.\n- in some window managers, if smart resize was enabled, urxvt\n  erroneously moved the window on font change - awesome bug\n  #532, arch linux bug ##34807 (patch by Uli Schlachter).\n- fix urxvtd crash when using a background expression.\n- properly restore colors when using fading and reverse video\n  is enabled while urxvt is focused and then disabled while it\n  is not focused, or vice versa (patch by Daniel Hahler).\n- fix high memory usage when an extension repeatedly hides and\n  shows an overlay (reported by Marcel Lautenbach).\n- expose priv_modes member and constants to perl extensions\n  (patch by Rastislav Barlik).\n- fix a whole slew of const sillyness, unfortunately forced upon\n  us by ISO C++.\n- update to libecb 0x00010006.\n- disable all thread support in ecb.h as we presumably don't need it.\n- slightly improve Makefile source dependencies.\n- work around bugs in newer Pod::Xhtml versions (flags incorrect formatting codes\n  in xhtml/html sections but does not interpret correct ones).\n- New file: /usr/bin/urclock\n- restore the -256color binaries\n","status":"published","published":"2022-11-30T08:19:21Z","modified":"2026-02-04T03:10:58.499337Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:10526-1","title":"rxvt-unicode-9.22-1.1 on GA media","description":"These are all security issues fixed in the rxvt-unicode-9.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:17.908693Z","updated_at":"2026-11-02T16:58:34.487567Z"}]}}