{"id":"CVE-2022-45063","aliases":["ALSA-2025:7427","AZL-11429","CLSA-2022-1669236294","CLSA-2022-1669237302","CLSA-2022-1669238963","CLSA-2022-1669239895","CLSA-2022-1669242003","CLSA-2026-1777030519","DEBIAN-CVE-2022-45063","EUVD-2022-47985","GHSA-3cch-wj7f-8g8x","MGASA-2022-0441","OESA-2024-2236","OESA-2024-2237","OESA-2024-2238","OESA-2024-2239","RHSA-2025:7427","RLSA-2025:7427","SUSE-SU-2023:0173-1","SUSE-SU-2023:0221-1","SUSE-SU-2023:0582-1","UBUNTU-CVE-2022-45063","openSUSE-SU-2024:12505-1"],"status":"published","title":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have...","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0656,"percentile":0.93862,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2022-11-10T00:00:00Z","modified":"2026-10-29T11:32:16Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"xterm","fixed_in":["366-10.el9_6"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"xterm-resize","fixed_in":["366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"xterm","fixed_in":["380-1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"xterm","fixed_in":["253-2.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"xterm","fixed_in":["331-1.el8_3.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"xterm-resize","fixed_in":["331-1.el8_3.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"xterm","fixed_in":["331-1.el8_3.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"xterm-resize","fixed_in":["331-1.el8_3.2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"xterm","fixed_in":["253-2.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"xterm","fixed_in":["322-1ubuntu1.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"xterm","fixed_in":["331-2.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"xterm-resize","fixed_in":["331-2.el8.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xterm","fixed_in":["375-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xterm","fixed_in":["375-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xterm","fixed_in":["375-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"xterm","fixed_in":["376-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xterm","fixed_in":["334-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"xterm","fixed_in":["363-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xterm","fixed_in":["363-6.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"xterm","fixed_in":["363-6.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-debuginfo","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-debugsource","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-resize","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-resize-debuginfo","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"xterm","fixed_in":["0:366-10.el9_6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xterm","fixed_in":["330-150000.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xterm","fixed_in":["330-150000.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xterm","fixed_in":["330-150000.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"xterm","fixed_in":["330-150000.4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xterm","fixed_in":["330-150200.11.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xterm","fixed_in":["308-5.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xterm","fixed_in":["375-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"366-10.el9_6"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"xterm-resize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"380-1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"253-2.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-1.el8_3.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"xterm-resize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-1.el8_3.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-1.el8_3.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"xterm-resize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-1.el8_3.2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"253-2.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"322-1ubuntu1.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-2.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"xterm-resize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331-2.el8.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"375-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"375-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"375-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"376-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"334-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"363-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"363-6.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"363-6.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-resize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"xterm-resize-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:366-10.el9_6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150000.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150000.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150000.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150000.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-ESPOS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"308-5.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["318-2ubuntu1","318-2ubuntu2","322-1ubuntu1","322-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["324-2ubuntu1","330-1ubuntu1","330-1ubuntu2","330-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["348-2ubuntu1","353-1ubuntu1","353-1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["366-1ubuntu1","369-1ubuntu1","370-1ubuntu1","370-2ubuntu1","371-1ubuntu1","372-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"375-2.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"invisible-island","product":"xterm"}],"references":[{"url":"https://invisible-island.net/xterm/xterm.log.html","tags":["x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/11/10/1","tags":["x_transferred","Mailing List","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://news.ycombinator.com/item?id=33546415","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/10/1","tags":["mailing-list","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/11/10/5","tags":["mailing-list","x_transferred","Mailing List","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202211-09","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5T2JI5JCHPTXX2KJU45H2XAHQSFVEJ2Y/","tags":["vendor-advisory","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/15/1","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2024/06/17/1","tags":["mailing-list","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/1"},{"url":"http://www.openwall.com/lists/oss-security/2026/04/08/10"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45063","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5T2JI5JCHPTXX2KJU45H2XAHQSFVEJ2Y"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4TPVNTYFFWNTGZJJQAA4MGGFSTXA4XEA"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5T2JI5JCHPTXX2KJU45H2XAHQSFVEJ2Y"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC"},{"url":"https://github.com/advisories/GHSA-3cch-wj7f-8g8x"},{"url":"https://access.redhat.com/errata/RHSA-2025:7427","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-45063","tags":["report"]},{"url":"https://bugzilla.redhat.com/2142474","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-7427.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1669236294.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1669237302.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1669238963.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1669239895.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2022-1669242003","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1777030519.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45063","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0441.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31108","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IVD3I2ZFXGOY6BA2FNS7WPFMPFBDHFWC/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2236","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2237","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2238","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2239","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2142474","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7427.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45063","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2025:7427","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205305","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45063","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230582-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45063","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-45063","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2026-04-08T17:24:10.36Z","updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-47985","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T00:00:00Z","modified":"2026-04-08T17:24:10Z","updated_at":"2026-11-02T19:24:40.052372Z"}],"ghsa":[{"id":"GHSA-3cch-wj7f-8g8x","title":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have...","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T19:01:07Z","modified":"2026-04-08T21:31:45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:07:18.583007Z"}],"nvd":[{"id":"CVE-2022-45063","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T16:15:12.307Z","modified":"2026-06-17T05:09:16.857Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"AZL-11429","title":"CVE-2022-45063 affecting package xterm for versions less than 380-1","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T16:15:12Z","modified":"2026-04-21T04:22:06.994458Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:02.666535Z"},{"id":"CVE-2022-45063","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T16:15:12.307Z","modified":"2026-04-16T04:32:00.068465984Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-45063","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T16:15:12.307Z","modified":"2026-11-03T08:03:56.171486202Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:23:34.488036Z"},{"id":"OESA-2024-2236","title":"xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals.\r\n\r\nSecurity Fix(es):\r\n\r\nxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.(CVE-2022-45063)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:34.436079807Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2237","title":"xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals.\r\n\r\nSecurity Fix(es):\r\n\r\nxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.(CVE-2022-45063)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:34.503928753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2238","title":"xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals.\r\n\r\nSecurity Fix(es):\r\n\r\nxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.(CVE-2022-45063)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:34.527738772Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2239","title":"xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals.\r\n\r\nSecurity Fix(es):\r\n\r\nxterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.(CVE-2022-45063)","status":"published","published":"2024-10-12T11:07:42Z","modified":"2026-08-18T01:17:35.464805756Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2025:7427","title":"Red Hat Security Advisory: xterm security update","status":"published","published":"2025-05-14T10:06:21Z","modified":"2026-08-27T10:05:18Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:17.133041Z"},{"id":"RLSA-2025:7427","title":"Low: xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly. \n\nSecurity Fix(es):\n\n* xterm: code execution via OSC 50 input sequences (CVE-2022-45063)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-07T17:39:33.082363Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2022-45063","description":"xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.","status":"published","published":"2022-11-10T16:15:00Z","modified":"2025-10-24T04:53:59Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"ALSA-2025:7427","title":"Low: xterm security update","description":"The xterm program is a terminal emulator for the X Window System. It provides DEC VT102 and Tektronix 4014 compatible terminals for programs that can't use the window system directly.   \n\nSecurity Fix(es):  \n\n  * xterm: code execution via OSC 50 input sequences (CVE-2022-45063)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:32:16.410382022Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2022-1669236294","title":"xterm: Fix of CVE-2022-45063","description":"- CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window\n- Add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to help with error\n  recovery for a missing font","status":"published","published":"2022-11-23T20:44:54Z","modified":"2026-06-01T00:32:13.718827441Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1669237302","title":"xterm: Fix of CVE-2022-45063","description":"- CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window\n- Add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to help with error\n  recovery for a missing font","status":"published","published":"2022-11-23T21:01:42Z","modified":"2026-06-01T00:33:20.265668875Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1669238963","title":"xterm: Fix of CVE-2022-45063","description":"- CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window\n- Add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to help with error\n  recovery for a missing font","status":"published","published":"2022-11-23T21:29:23Z","modified":"2026-06-01T00:33:21.602899566Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1669239895","title":"xterm: Fix of CVE-2022-45063","description":"- CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window\n- Add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to help with error\n  recovery for a missing font","status":"published","published":"2022-11-23T21:44:55Z","modified":"2026-06-01T00:33:24.578426616Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2022-1669242003","title":"Fix CVE(s): CVE-2022-45063","description":"\n   * SECURITY UPDATE: possible RCE when using OSC 50 sequence\n     - debian/patches/CVE-2022-45063.patch: Improve error recovery when\n       setting a bitmap font for the VT100 window, e.g., in case OSC 50\n       failed, restoring the most recent valid font so that a subsequent\n       OSC 50 reports this correctly.\n     - CVE-2022-45063\n     - debian/patches/extra_safety_to_string_comparison_functions.patch:\n       Add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to\n       help with error recovery for a missing font.","status":"published","published":"2022-11-23T22:20:03Z","modified":"2026-06-04T10:03:27.344138Z","updated_at":"2026-11-02T15:43:40.176048Z"},{"id":"CLSA-2026-1777030519","title":"xterm: Fix of CVE-2022-45063","description":"- CVE-2022-45063: improve error recovery when setting a bitmap font for the VT100 window\n- add NULL pointer checks in x_strcasecmp() and x_strncasecmp() to help with error\n  recovery for a missing font","status":"published","published":"2026-04-24T11:35:23Z","modified":"2026-06-01T00:33:14.724055879Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"MGASA-2022-0441","title":"Updated xterm packages fix security vulnerability","description":"xterm before patch 375 can enable an RCE under certain conditions.\n","status":"published","published":"2022-11-27T20:51:49Z","modified":"2026-04-16T04:43:37.355657699Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12505-1","title":"xterm-375-2.1 on GA media","description":"These are all security issues fixed in the xterm-375-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:15:29.364962Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0173-1","title":"Security update for xterm","description":"This update for xterm fixes the following issues:\n\n- CVE-2022-45063: Fixed an arbitrary code execution issue under\n  configurations using vi and zsh (bsc#1205305).\n","status":"published","published":"2023-01-26T17:34:14Z","modified":"2026-02-04T02:57:08.120838Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0221-1","title":"Security update for xterm","description":"This update for xterm fixes the following issues:\n\n- CVE-2022-45063: Fixed an arbitrary code execution issue under\n  configurations using vi and zsh (bsc#1205305).\n","status":"published","published":"2023-02-01T08:34:39Z","modified":"2025-05-02T04:33:49.984228Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0582-1","title":"Security update for xterm","description":"This update for xterm fixes the following issues:\n  \n  - CVE-2022-45063: Fixed command injection in ESC 50 fontoperation by disabling the change font functionality (bsc#1205305).\n","status":"published","published":"2023-02-28T17:12:51Z","modified":"2026-02-04T04:40:41.671392Z","updated_at":"2026-11-02T15:53:51.853735Z"}]}}