CVE-2008-1142

LowCVSS 3.7/10Last modified Jun 16, 2026

Description

rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.

Metrics

CVSS 2.0 3.7/10AV:L/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://article.gmane.org/gmane.comp.security.oss.general/122
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
http://secunia.com/advisories/29576Vendor Advisory
http://secunia.com/advisories/30224Vendor Advisory
http://secunia.com/advisories/30225Vendor Advisory
http://secunia.com/advisories/30226Vendor Advisory
http://secunia.com/advisories/30227Vendor Advisory
http://secunia.com/advisories/30229Vendor Advisory
http://secunia.com/advisories/31687Vendor Advisory
http://security.gentoo.org/glsa/glsa-200805-03.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:161
http://www.mandriva.com/security/advisories?name=MDVSA-2008:221
http://www.securityfocus.com/bid/28512Patch
http://article.gmane.org/gmane.comp.security.oss.general/122
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
http://secunia.com/advisories/29576Vendor Advisory
http://secunia.com/advisories/30224Vendor Advisory
http://secunia.com/advisories/30225Vendor Advisory
http://secunia.com/advisories/30226Vendor Advisory
http://secunia.com/advisories/30227Vendor Advisory
http://secunia.com/advisories/30229Vendor Advisory
http://secunia.com/advisories/31687Vendor Advisory
http://security.gentoo.org/glsa/glsa-200805-03.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:161
http://www.mandriva.com/security/advisories?name=MDVSA-2008:221
http://www.securityfocus.com/bid/28512Patch

Timeline

Published: Apr 7, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-11446.3The Marvell driver for the Netgear WN802T Wi-Fi access point with firmware 1.3.16 on the Marvell 88W8361P-BEM1 chipset does not properly par CVE-2008-11455.0Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems CVE-2008-11466.8A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 3-bit random hops (aka "Algorithm X3"), as used in OpenBSD 2.8 t CVE-2008-11476.8A certain pseudo-random number generator (PRNG) algorithm that uses XOR and 2-bit random hops (aka "Algorithm X2"), as used in OpenBSD 2.6 t CVE-2008-11486.8A certain pseudo-random number generator (PRNG) algorithm that uses ADD with 0 random hops (aka "Algorithm A0"), as used in OpenBSD 3.5 thro CVE-2008-11495.1phpMyAdmin before 2.11.5 accesses $_REQUEST to obtain some parameters instead of $_GET and $_POST, which allows attackers in the same domain CVE-2008-11507.1The virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of service (resource CVE-2008-11517.1Memory leak in the virtual private dial-up network (VPDN) component in Cisco IOS before 12.3 allows remote attackers to cause a denial of se CVE-2008-11527.8The data-link switching (DLSw) component in Cisco IOS 12.0 through 12.4 allows remote attackers to cause a denial of service (device restart CVE-2008-11537.1Cisco IOS 12.1, 12.2, 12.3, and 12.4, with IPv4 UDP services and the IPv6 protocol enabled, allows remote attackers to cause a denial of ser CVE-2008-115410.0The Disaster Recovery Framework (DRF) master server in Cisco Unified Communications products, including Unified Communications Manager (CUCM CVE-2008-115510.0Cisco Network Admission Control (NAC) Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attack