CVE-2006-7236 Misconfiguration in n/a
User-assisted attackers can execute arbitrary code via escape sequences due to the default allowWindowOps setting in Debian's xterm.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2006-7236?
CVE-2006-7236 is a critical vulnerability in n/a, published on 2 Jan 2009. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The default configuration of xterm on Debian GNU/Linux sid and possibly Ubuntu enables the allowWindowOps resource, which allows user-assisted attackers to execute arbitrary code or have unspecified other impact via escape sequences.
Weakness: CWE-16
Which versions are affected by CVE-2006-7236?
It affects 1 product.
Products include Invisible-Island Xterm.
How do I fix CVE-2006-7236?
Change a configuration setting.
Is CVE-2006-7236 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-7236 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2006-7236, GHSA-9r87-p9p6-pqp9.