CVE-2014-3121

Severity: high (CVSS 7.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-14 · updated 2026-06-17
Weakness: CWE-78

Description

rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.

Affected products

Marc Lehmann Rxvt-Unicode: through 9.19; 9.0, 9.01, 9.02, 9.05, 9.06, 9.07 (+10)

References

http://dist.schmorp.de/rxvt-unicode/Changes
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html
http://lists.opensuse.org/opensuse-updates/2014-06/msg00038.html
http://seclists.org/oss-sec/2014/q2/204
http://www.debian.org/security/2014/dsa-2925
http://www.securityfocus.com/bid/67155
https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133166.html
https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133195.html
http://dist.schmorp.de/rxvt-unicode/Changes
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00026.html
http://lists.opensuse.org/opensuse-updates/2014-06/msg00038.html
http://seclists.org/oss-sec/2014/q2/204

Get alerted when CVE-2014-3121 or the next vulnerability affects your stack