4 ms·
It's not quite as bad as that; it sounds like you also have to select the text. (The corresponding vulnerability in "screen", by contrast, doesn't require inter
by JoshTriplett 6y ago
It's not quite as bad as that; it sounds like you also have to select the text. (The corresponding vulnerability in "screen", by contrast, doesn't require interaction, which makes it even more serious.)
It's still extremely bad and should be patched immediately. But it doesn't appear to be a zero-interaction vulnerability, as far as I can tell from the description.
- kstrauser 6y agoI haven’t seen that yet. Do you have a link saying that you have to select text? That would help a lot in the mean time if true.
- JoshTriplett 6y agoSee https://www.openwall.com/lists/oss-security/2021/02/09/7 https://www.openwall.com/lists/oss-security/2021/02/09/7 : > To reproduce in XTerm, decode the file then try to select the line. For the original report on screen, see https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html https://lists.gnu.org/archive/html/screen-devel/2021-02/msg0... (warning, contains the raw test case, may crash a text-based browser).
- craig131 6y agohttps://invisible-island.net/xterm/xterm.log.html#xterm_366 https://invisible-island.net/xterm/xterm.log.html#xterm_366 Specifically, the overflow is in the upper limit of the text selection buffer when characters are combined in UTF-8.