CVE-2010-2713

Publication date 16 July 2010

Last updated 24 July 2024

Ubuntu priority

The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence. NOTE: this issue exists because of a CVE-2003-0070 regression.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
vte	10.04 LTS lucid	Fixed 1:0.23.5-0ubuntu1.1
	9.10 karmic	Fixed 1:0.22.2-0ubuntu2.1
	9.04 jaunty	Fixed 1:0.20.0-0ubuntu2.1
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected

How can I get the fixes?
What do statuses mean?

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-962-1
VTE vulnerability
15 July 2010

Other references

https://www.cve.org/CVERecord?id=CVE-2010-2713