CVE-2023-40359 Integer overflow in n/a
An integer overflow in xterm's ReGIS reporting allows code execution when the experimental feature is enabled at compile time.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40359?
CVE-2023-40359 is a critical vulnerability in n/a, published on 14 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.
Which versions are affected by CVE-2023-40359?
It affects 1 product.
Linux distribution packages (7)
xterm SUSE:Linux Enterprise Module for Basesystem 15 SP4 | All versions | 330-150200.11.12.1 |
xterm SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 330-150200.11.12.1 |
xterm SUSE:Manager Proxy 4.2 | All versions | 330-150200.11.12.1 |
xterm SUSE:Manager Server 4.2 | All versions | 330-150200.11.12.1 |
xterm openSUSE:Leap 15.4 | All versions | 330-150200.11.12.1 |
xterm openSUSE:Leap 15.5 | All versions | 330-150200.11.12.1 |
xterm openSUSE:Tumbleweed | All versions | 384-2.1 |
Products include Invisible-Island Xterm.
How do I fix CVE-2023-40359?
Upgrade to a fixed version.
Is CVE-2023-40359 being exploited?
There is no known exploitation of CVE-2023-40359 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-27957, DEBIAN-CVE-2023-40359, GHSA-cwvr-vg72-6p6j, SUSE-SU-2023:4438-1, UBUNTU-CVE-2023-40359, openSUSE-SU-2024:13240-1.