CVE-2022-45063
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default configurations of some Linux distributions.
- Affected products
- Alt Linux, Almalinux, Astra Linux, Debian, Red Hat, Red Os, Rocky Linux, Suse
- Invisible-island Xterm
- < 375
- Fix
- Available
- CVSS 3.1
- 9.8 CRITICAL
- EPSS
- 4.9% (91th percentile)
- Weakness
- CWE-77
- NVD status
- Modified
- Published
- 2022-11-10
CVE-2022-45063 at NVD
No indexed exploits for CVE-2022-45063 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2022-45063 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.