{"id":"CVE-2023-40359","aliases":["AZL-27957","DEBIAN-CVE-2023-40359","EUVD-2023-44930","GHSA-cwvr-vg72-6p6j","SUSE-SU-2023:4438-1","UBUNTU-CVE-2023-40359","openSUSE-SU-2024:13240-1"],"status":"published","title":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected...","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00855,"percentile":0.58628,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-14T00:00:00Z","modified":"2026-10-26T18:02:32Z","fixes":[{"ecosystem":"Azure Linux:2","package":"xterm","fixed_in":["380-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xterm","fixed_in":["382-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xterm","fixed_in":["382-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.2","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.2","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xterm","fixed_in":["330-150200.11.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xterm","fixed_in":["384-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"380-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["379-1","380-1","381-1","382-1","382-2","383-1","384-1","385-1","386-1","387-1","388-1","389-1","390-1","391-1","392-1","393-1","394-1","395-1","396-1","397-1","398-1","399-1","401-1","402-1","403-1","404-1","405-1","406-1","407-1","409-1","410-1","411-1","412-1"]},{"source":"osv","ecosystem":"Debian:13","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"382-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"382-2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"330-150200.11.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["318-2ubuntu1","318-2ubuntu2","322-1ubuntu1","322-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["324-2ubuntu1","330-1ubuntu1","330-1ubuntu2","330-1ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["348-2ubuntu1","353-1ubuntu1","353-1ubuntu1.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["366-1ubuntu1","369-1ubuntu1","370-1ubuntu1","370-2ubuntu1","371-1ubuntu1","372-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xterm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"384-2.1"}]}]}],"products":[{"vendor":"invisible-island","product":"xterm"}],"references":[{"url":"https://invisible-island.net/xterm/xterm.log.html#xterm_380","tags":["x_transferred","Release Notes","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40359","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cwvr-vg72-6p6j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-40359","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234438-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214282","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40359","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-40359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40359","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-40359","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T00:00:00Z","modified":"2024-10-09T14:50:22.239Z","updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-44930","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T00:00:00Z","modified":"2024-10-09T14:50:22Z","updated_at":"2026-11-03T00:27:43.39457Z"}],"ghsa":[{"id":"GHSA-cwvr-vg72-6p6j","title":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected...","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue.","status":"published","published":"2023-08-14T18:32:59Z","modified":"2024-04-04T06:55:10Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:56:46.449942Z"}],"nvd":[{"id":"CVE-2023-40359","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T17:15:10.617Z","modified":"2026-06-17T06:17:25.103Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:08:24.487686Z"}],"osv":[{"id":"AZL-27957","title":"CVE-2023-40359 affecting package xterm for versions less than 380-1","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T17:15:10Z","modified":"2026-04-21T04:25:45.034829Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"CVE-2023-40359","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T17:15:10.617Z","modified":"2026-03-14T12:17:11.91617Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-40359","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T17:15:10.617Z","modified":"2026-10-26T18:02:32.185447403Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-40359","description":"xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.","status":"published","published":"2023-08-14T17:15:00Z","modified":"2025-10-24T05:02:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"openSUSE-SU-2024:13240-1","title":"xterm-384-2.1 on GA media","description":"These are all security issues fixed in the xterm-384-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:58:08.114967Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:4438-1","title":"Security update for xterm","description":"This update for xterm fixes the following issues:\n\n- CVE-2023-40359: Fixed reporting characterset names in ReGiS graphics mode. (bsc#1214282)\n","status":"published","published":"2023-11-14T11:12:50Z","modified":"2026-02-04T03:43:42.505317Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}