CVE-2024-38395

Опубликовано: 16 июн. 2024

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

Ссылки

http://www.openwall.com/lists/oss-security/2024/06/17/1
Mailing List
Third Party Advisory
https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
Patch
https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
Release Notes
https://iterm2.com/downloads.html
Product
https://www.openwall.com/lists/oss-security/2024/06/15/1
Mailing List
http://www.openwall.com/lists/oss-security/2024/06/17/1
Mailing List
Third Party Advisory
https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
Patch
https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
Release Notes
https://iterm2.com/downloads.html
Product
https://www.openwall.com/lists/oss-security/2024/06/15/1
Mailing List

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:iterm2:iterm2:*:*:*:*:*:*:*:*

Версия от 3.5.0 (включая) до 3.5.2 (исключая)

EPSS

Процентиль: 93%

0.09237

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-94

Связанные уязвимости

GHSA-m869-mpfx-h3g2