{"id":"CVE-2010-2713","aliases":["DEBIAN-CVE-2010-2713","EUVD-2010-2717","GHSA-h3vh-54q4-255x"],"status":"published","title":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE...","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03343,"percentile":0.88744,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2010-08-05T18:00:00Z","modified":"2026-10-23T17:47:37Z","fixes":[{"ecosystem":"Debian:12","package":"vte","fixed_in":["1:0.24.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vte","fixed_in":["1:0.24.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vte","fixed_in":["1:0.24.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vte","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.24.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vte","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.24.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vte","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.24.3-1"}]}]}],"products":[{"vendor":"nalin_dahyabhai","product":"vte"}],"references":[{"url":"http://www.ubuntu.com/usn/usn-962-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/1839","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/41716","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://git.gnome.org/browse/vte/commit/?id=8b971a7b2c59902914ecbbc3915c45dd21530a91","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=613110","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/40635","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-2713"},{"url":"https://github.com/advisories/GHSA-h3vh-54q4-255x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-2713","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-2713","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2010-08-05T18:00:00Z","modified":"2024-08-07T02:39:38.067Z","updated_at":"2026-11-02T14:33:27.01833Z"}],"euvd":[{"id":"EUVD-2010-2717","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2010-08-05T18:00:00Z","modified":"2024-08-07T02:39:38Z","updated_at":"2026-11-03T01:39:36.439258Z"}],"ghsa":[{"id":"GHSA-h3vh-54q4-255x","title":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE...","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2022-05-17T05:48:31Z","modified":"2023-01-28T05:05:00Z","updated_at":"2026-11-02T14:44:17.062669Z"}],"nvd":[{"id":"CVE-2010-2713","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2010-08-05T18:17:57.62Z","modified":"2026-06-16T23:21:22.55Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:49.736647Z"}],"osv":[{"id":"CVE-2010-2713","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2010-08-05T18:17:57Z","modified":"2026-04-10T03:41:20.08963Z","updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2010-2713","description":"The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.","status":"published","published":"2010-08-05T18:17:57.62Z","modified":"2026-10-23T17:47:37.16228817Z","updated_at":"2026-11-02T15:45:24.316685Z"}]}}