CVE-2017-7483 Integer overflow in rxvt
An attacker can cause a denial of service in the Rxvt terminal emulator by sending a specific terminal escape code that triggers an integer overflow and subsequent crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-7483?
CVE-2017-7483 is a high-severity vulnerability in Debian Debian Linux, published on 2 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-invertible integer that eventually leads to a segfault due to an out of bounds read.
Weakness: CWE-125
Which versions are affected by CVE-2017-7483?
It affects 2 products.
Linux distribution packages (1)
rxvt-unicode openSUSE:Tumbleweed | All versions | 9.26-3.3 |
Products include Debian Debian Linux, Rxvt Project Rxvt.
How do I fix CVE-2017-7483?
Apply the vendor's patch.
Is CVE-2017-7483 being exploited?
There is no known exploitation of CVE-2017-7483 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-9j3p-4pfr-4vxw, UBUNTU-CVE-2017-7483, openSUSE-SU-2024:11361-1.