CVE-2008-1142
LOW · CVSS 3.7EPSS 0.4%EU EUVD
rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.
Key facts
- CVSS score
- 3.7 (v2.0)
- Severity
- LOW
- CVSS vector
AV:L/AC:H/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-264
- EPSS score
- 0.4% (30th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2008-1151)
- Published
- April 7, 2008
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2008-1151 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- aterm / aterm
- eterm / eterm
- eterm / eterm
- mrxvt / mrxvt
- mrxvt / mrxvt
- multi-aterm / multi-aterm
- multi-aterm / multi-aterm
- multi-aterm / multi-aterm
- multi-aterm / multi-aterm
- multi-aterm / multi-aterm
- multi-aterm / multi-aterm
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt / rxvt
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
- rxvt-unicode / rxvt-unicode
and 68 more…
References
- http://article.gmane.org/gmane.comp.security.oss.general/122
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296(Vendor Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
- http://secunia.com/advisories/29576(Vendor Advisory)
- http://secunia.com/advisories/30224(Vendor Advisory)
- http://secunia.com/advisories/30225(Vendor Advisory)
- http://secunia.com/advisories/30226(Vendor Advisory)
- http://secunia.com/advisories/30227(Vendor Advisory)
- http://secunia.com/advisories/30229(Vendor Advisory)
- http://secunia.com/advisories/31687(Vendor Advisory)
- http://security.gentoo.org/glsa/glsa-200805-03.xml
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:161
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:221
- http://www.securityfocus.com/bid/28512(Patch)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain