{"id":"CVE-2021-33477","aliases":["ALPINE-CVE-2021-33477","DEBIAN-CVE-2021-33477","DLA-2671-1","DLA-2681-1","DLA-2682-1","DLA-2683-1","EUVD-2021-20180","GHSA-vm2c-wqqr-v3gc","MGASA-2021-0358","UBUNTU-CVE-2021-33477","USN-8991-1","openSUSE-SU-2022:10222-1","openSUSE-SU-2024:12386-1"],"status":"published","title":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code...","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04089,"percentile":0.90803,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2021-05-20T19:16:01Z","modified":"2026-11-04T03:43:14Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"mrxvt","fixed_in":["0.5.4-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"mrxvt","fixed_in":["0.5.4-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mrxvt","fixed_in":["0.5.4-r9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.10","package":"rxvt-unicode","fixed_in":["9.22-r7"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"rxvt-unicode","fixed_in":["9.22-r8"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"rxvt-unicode","fixed_in":["9.22-r10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rxvt-unicode","fixed_in":["9.26-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"eterm","fixed_in":["0.9.6-6.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"eterm","fixed_in":["0.9.6-6.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rxvt-unicode","fixed_in":["9.22-11"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rxvt-unicode","fixed_in":["9.22-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rxvt-unicode","fixed_in":["9.22-11"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"rxvt-unicode","fixed_in":["9.22-1+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"eterm","fixed_in":["0.9.6-5+deb9u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"mrxvt","fixed_in":["0.5.4-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"rxvt-unicode","fixed_in":["9.26-1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"mrxvt","fixed_in":["0.5.4-15.1.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"eterm","fixed_in":["0.9.7-3.1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rxvt-unicode","fixed_in":["9.21-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rxvt-unicode","fixed_in":["9.22-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rxvt-unicode","fixed_in":["9.22-6ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rxvt-unicode","fixed_in":["9.30-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-r9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.10","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-r7"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-r8"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-r10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-6.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-6.1"}]}],"versions":["0.7-1","0.8.10-10","0.8.7-0.4","0.8.7-0.4.1","0.9.2-0pre2002042903","0.9.2-0pre2002042903.3","0.9.2-8","0.9.2-8.1","0.9.3-1","0.9.4.0debian1-1","0.9.4.0debian1-2","0.9.4.0debian1-2.1","0.9.5-1","0.9.5-2","0.9.5-3","0.9.5-4","0.9.5-5","0.9.6-1","0.9.6-2","0.9.6-3","0.9.6-4","0.9.6-5","0.9.6-6"]},{"source":"osv","ecosystem":"Debian:12","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-11"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-11"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-1+deb9u1"}]}],"versions":["9.22-1"]},{"source":"osv","ecosystem":"Debian:9","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.6-5+deb9u1"}]}],"versions":["0.9.6-5"]},{"source":"osv","ecosystem":"Debian:9","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-2+deb9u1"}]}],"versions":["0.5.4-2"]},{"source":"osv","ecosystem":"Debian:9","package":"rxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.7.10-7+deb9u2"}]}],"versions":["1:2.7.10-7","1:2.7.10-7+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-15.1.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.7-3.1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-1","0.9.6-3","0.9.6-4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mrxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4-1.1","0.5.4-1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rxvt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:2.7.10-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.21-1ubuntu0.1~esm1"}]}],"versions":["9.21-1","9.21-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-3ubuntu0.1~esm1"}]}],"versions":["9.22-1build2","9.22-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"eterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-6build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-6ubuntu0.1~esm1"}]}],"versions":["9.22-6build1","9.22-6build2","9.22-6build3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.21-1ubuntu0.1~esm1"}]}],"versions":["9.21-1","9.21-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-3ubuntu0.1~esm1"}]}],"versions":["9.22-1build2","9.22-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.22-6ubuntu0.1~esm1"}]}],"versions":["9.22-6build1","9.22-6build2","9.22-6build3"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.26-bp154.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rxvt-unicode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.30-2.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"eterm_project","product":"eterm"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mrxvt_project","product":"mrxvt"},{"vendor":"rxvt-unicode_project","product":"rxvt-unicode"},{"vendor":"rxvt_project","product":"rxvt"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2021/05/17/1","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory","evidence","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2017/05/01/20","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://cvs.schmorp.de/rxvt-unicode/src/command.C?r1=1.582\u0026r2=1.583","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://packetstormsecurity.com/files/162621/rxvt-2.7.0-rxvt-unicode-9.22-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","report"]},{"url":"https://sourceforge.net/projects/rxvt/files/rxvt-dev/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","report"]},{"url":"http://cvs.schmorp.de/rxvt-unicode/Changes?view=log","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://sourceforge.net/projects/materm/files/mrxvt%20source/","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","report"]},{"url":"https://git.enlightenment.org/apps/eterm.git/log/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202105-17","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZWGE2RJONBEHSPCBUAW72NTRTIFKZAX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLPVEPBH37EBR4R54RMC6GD33J37HJXD/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAKO6N6NKTR6Z6KVAPEXSZQMRU52SGA/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00010.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00012.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00011.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AO52OLNOOKOCZSJCN3R7Q25XA32BWNWP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUV4LDVZVW7KCGPAMFZD4ZJ4FVLPOX4C/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202209-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33477"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AO52OLNOOKOCZSJCN3R7Q25XA32BWNWP/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DUV4LDVZVW7KCGPAMFZD4ZJ4FVLPOX4C/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZWGE2RJONBEHSPCBUAW72NTRTIFKZAX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLPVEPBH37EBR4R54RMC6GD33J37HJXD/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXAKO6N6NKTR6Z6KVAPEXSZQMRU52SGA/"},{"url":"https://github.com/advisories/GHSA-vm2c-wqqr-v3gc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-33477","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33477","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0358.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28939","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/05/17/2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6RFMU5YXXNYYVA7G2DAHRXXHO6JKVFUT/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/UXAKO6N6NKTR6Z6KVAPEXSZQMRU52SGA/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2681","tags":["web"]},{"url":"https://www.debian.org/lts/security/2021/dla-2682","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-33477","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33477","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8991-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YIRRHCE53YNBLDGNULGNED3XGUMUZDMO/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186174","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33477","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T19:16:01Z","modified":"2024-08-03T23:50:42.963Z","updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-20180","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T19:16:01Z","modified":"2024-08-03T23:50:42Z","updated_at":"2026-11-03T03:24:34.304953Z"}],"ghsa":[{"id":"GHSA-vm2c-wqqr-v3gc","title":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code...","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2022-05-24T19:02:49Z","modified":"2023-02-02T05:04:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:51:59.92181Z"}],"nvd":[{"id":"CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T20:15:07.397Z","modified":"2026-06-17T03:54:36.84Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"ALPINE-CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T20:15:07.397Z","modified":"2026-11-03T06:32:47.479736543Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T20:15:07.397Z","modified":"2026-10-24T10:30:18.546487418Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T20:15:07.397Z","modified":"2026-10-23T18:04:01.065647007Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-33477","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.","status":"published","published":"2021-05-20T20:15:00Z","modified":"2026-11-04T03:30:05.152762747Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T03:56:45.249606Z"},{"id":"DLA-2671-1","title":"rxvt-unicode - security update","status":"published","published":"2021-05-30T00:00:00Z","modified":"2026-03-09T01:19:13.949686Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2681-1","title":"eterm - security update","status":"published","published":"2021-06-09T00:00:00Z","modified":"2026-03-09T01:18:43.925095Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2682-1","title":"mrxvt - security update","status":"published","published":"2021-06-09T00:00:00Z","modified":"2026-03-09T01:19:37.60461Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DLA-2683-1","title":"rxvt - security update","status":"published","published":"2021-06-09T00:00:00Z","modified":"2026-03-09T01:23:20.239002Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0358","title":"Updated rvxt-unicode, mxrvt, eterm packages fix security vulnerability","description":"rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially\nremote) code execution because of improper handling of certain escape sequences\n(ESC G Q). A response is terminated by a newline (CVE-2021-33477).\n","status":"published","published":"2021-07-20T10:46:47Z","modified":"2026-04-16T04:42:11.680509736Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2022:10222-1","title":"Security update for rxvt-unicode","description":"This update for rxvt-unicode fixes the following issues:\n\nUpdate to 9.26\n\n- ev_iouring.c was wrongly required during compilation, and wrongly\n  not packaged.\n\nUpdate to 9.25 (boo#1186174 CVE-2021-33477)\n\n- for the 17.5th anniversary, and because many distributions seem to\n  remove rxvt in favour of urxvt, this release resurrects rclock as\n  urclock.\n- add support for systemd socket-based activation - debian bug #917105,\n  freebsd bug #234276.\n- do not destruct perl on exit anymore: this might fail for a variety of\n  reasons, and takes unneccessary time.\n- remove any macros from urxvtperl manpage(s), should fix debian\n  bug 858385.\n- the old bg image resources are now provided by the background\n  extension, and perl is thus required for bg image support. No\n  configuration change is needed: urxvt autoloads the background\n  ext if any bg image resource/option is present (for OSC sequences to\n  work you need to enable it explicity). The old bg image\n  resources are also now deprecated; users are encouraged to\n  switch to the new bg image interface (see man urxvt-background).\n- confirm-paste now checks for any ctlchars, not just newlines.\n- searchable scrollback will now ignore bracketed paste mode sequences\n  (prompted by Daniel Gröber's patch).\n- drop ISO 2022 locale support. ISO 2022 encodings are not supported in\n  POSIX locales and clash with vt100 charset emulation (the luit\n  program can be used as a substitute).\n- perl didn't parse rgba colours specified as an array correctly,\n  only allowing 0 and 100% intensity for each component (this affected\n  fill and tint).\n- when iterating over resources, urxvt will now try to properly handle\n  multipart resources (such as '*background.expr'), for the benefit\n  of autoloading perl extensions.\n- ESC G (query rxvt graphics mode) has been disabled due to security\n  implications. The rxvt graphics mode was removed in rxvt-unicode 1.5,\n  and no programs relying on being able to query the mode are known.\n- work around API change breakage in perl 5.28, based on a patch by\n  Roman Bogorodskiy.\n- improved security: rob nation's (obsolete) graphics mode queries\n  no longer reply with linefeed in secure/default mode.\n- ISO 8613-3 direct colour SGR sequences (patch by Fengguang Wu).\n- xterm focus reporting mode (patch by Daniel Hahler).\n- xterm SGR mouse mode.\n- implement DECRQM. Patch by Přemysl Eric Janouch.\n- add missing color index parameter to OSC 4 response. Patch\n  by Přemysl Eric Janouch.\n- in some window managers, if smart resize was enabled, urxvt\n  erroneously moved the window on font change - awesome bug\n  #532, arch linux bug ##34807 (patch by Uli Schlachter).\n- fix urxvtd crash when using a background expression.\n- properly restore colors when using fading and reverse video\n  is enabled while urxvt is focused and then disabled while it\n  is not focused, or vice versa (patch by Daniel Hahler).\n- fix high memory usage when an extension repeatedly hides and\n  shows an overlay (reported by Marcel Lautenbach).\n- expose priv_modes member and constants to perl extensions\n  (patch by Rastislav Barlik).\n- fix a whole slew of const sillyness, unfortunately forced upon\n  us by ISO C++.\n- update to libecb 0x00010006.\n- disable all thread support in ecb.h as we presumably don't need it.\n- slightly improve Makefile source dependencies.\n- work around bugs in newer Pod::Xhtml versions (flags incorrect formatting codes\n  in xhtml/html sections but does not interpret correct ones).\n- New file: /usr/bin/urclock\n- restore the -256color binaries\n","status":"published","published":"2022-11-30T08:19:21Z","modified":"2026-02-04T03:10:58.499337Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12386-1","title":"rxvt-unicode-9.30-2.1 on GA media","description":"These are all security issues fixed in the rxvt-unicode-9.30-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:04:23.576958Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"USN-8991-1","title":"rxvt-unicode vulnerability","description":"It was discovered that rxvt-unicode incorrectly handled certain escape\nsequences. An attacker could possibly use this issue to execute arbitrary\ncode if a user displayed specially crafted text in the terminal.","status":"published","published":"2026-11-03T17:37:49Z","modified":"2026-11-04T03:43:14.812270901Z","updated_at":"2026-11-04T03:56:18.279609Z"}]}}