CVE catalog
CVE-2021-33477
rxvt-unicode: CVE-2021-33477
- Severity
- High · CVSS 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 4.09% · Oct 25, 2026
rxvt-unicode 9.22, rxvt 2.7.10, mrxvt 0.5.4, and Eterm 0.9.7 allow (potentially remote) code execution because of improper handling of certain escape sequences (ESC G Q). A response is terminated by a newline.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | eterm | sid | 0.9.6-7.3 | fixed |
| Debian | eterm | forky | 0.9.6-7.3 | fixed |
| Debian | eterm | bookworm | 0.9.6-7 | fixed |
| Debian | rxvt-unicode | sid | 9.31-3.1 | fixed |
| Debian | rxvt-unicode | forky | 9.31-3.1 | fixed |
| Debian | rxvt-unicode | trixie | 9.31-3 | fixed |
| Debian | rxvt-unicode | bookworm | 9.30-2 | fixed |
| Alpine | mrxvt | 3.10 | 0.5.4-r8 | fixed |
| Alpine | mrxvt | 3.11 | 0.5.4-r8 | fixed |
| Alpine | rxvt-unicode | 3.10 | 9.22-r7 | fixed |
| Alpine | rxvt-unicode | 3.11 | 9.22-r8 | fixed |
| Ubuntu | eterm | 16.04 | 0.9.6-1 | vulnerable |
| Ubuntu | eterm | 16.04 | 0.9.6-3 | vulnerable |
| Ubuntu | eterm | 16.04 | 0.9.6-4 | vulnerable |
| Ubuntu | mrxvt | 16.04 | 0.5.4-1.1 | vulnerable |
| Ubuntu | mrxvt | 16.04 | 0.5.4-1.2 | vulnerable |
| Ubuntu | rxvt | 16.04 | 1:2.7.10-6 | vulnerable |
| Ubuntu | rxvt-unicode | 16.04 | 9.21-1 | vulnerable |
| Ubuntu | rxvt-unicode | 16.04 | 9.21-1build1 | vulnerable |
| Ubuntu | eterm | 18.04 | 0.9.6-5 | vulnerable |
| Ubuntu | rxvt-unicode | 18.04 | 9.22-1build2 | vulnerable |
| Ubuntu | rxvt-unicode | 18.04 | 9.22-3 | vulnerable |
| Ubuntu | eterm | 20.04 | 0.9.6-6build1 | vulnerable |
| Ubuntu | rxvt-unicode | 20.04 | 9.22-6build1 | vulnerable |
| Ubuntu | rxvt-unicode | 20.04 | 9.22-6build2 | vulnerable |
| Ubuntu | rxvt-unicode | 20.04 | 9.22-6build3 | vulnerable |
| Opensuse | rxvt-unicode | tumbleweed | 9.30-2.1 | fixed |
| Suse | rxvt-unicode | package hub 15 sp3 | 9.26-bp154.2.3.1 | fixed |
| Suse | rxvt-unicode | package hub 15 sp4 | 9.26-bp154.2.3.1 | fixed |
| Opensuse | rxvt-unicode | leap 15.3 | 9.26-bp154.2.3.1 | fixed |
| Opensuse | rxvt-unicode | leap 15.4 | 9.26-bp154.2.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | eterm | source | sid | 0.9.6-6.1 | not yet assigned | Not reported | [989041] |
| Debian | eterm | source | forky | 0.9.6-6.1 | not yet assigned | Not reported | [989041] |
| Debian | eterm | source | bookworm | 0.9.6-6.1 | not yet assigned | Not reported | [989041] |
| Debian | rxvt-unicode | source | sid | 9.22-11 | not yet assigned | Not reported | [988763] |
| Debian | rxvt-unicode | source | forky | 9.22-11 | not yet assigned | Not reported | [988763] |
| Debian | rxvt-unicode | source | trixie | 9.22-11 | not yet assigned | Not reported | [988763] |
| Debian | rxvt-unicode | source | bookworm | 9.22-11 | not yet assigned | Not reported | [988763] |
| Alpine | mrxvt | apk | 3.10 | 0.5.4-r8 | Not reported | ALPINE-CVE-2021-33477 | Not reported |
| Alpine | mrxvt | apk | 3.11 | 0.5.4-r8 | Not reported | ALPINE-CVE-2021-33477 | Not reported |
| Alpine | rxvt-unicode | apk | 3.10 | 9.22-r7 | Not reported | ALPINE-CVE-2021-33477 | Not reported |
| Alpine | rxvt-unicode | apk | 3.11 | 9.22-r8 | Not reported | ALPINE-CVE-2021-33477 | Not reported |
| Opensuse | rxvt-unicode | rpm | tumbleweed | 9.30-2.1 | Not reported | OPENSUSE-SU-2024:12386-1 | Not reported |
| Suse | rxvt-unicode | rpm | package hub 15 sp3 | 9.26-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10222-1 | Not reported |
| Suse | rxvt-unicode | rpm | package hub 15 sp4 | 9.26-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10222-1 | Not reported |
| Opensuse | rxvt-unicode | rpm | leap 15.3 | 9.26-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10222-1 | Not reported |
| Opensuse | rxvt-unicode | rpm | leap 15.4 | 9.26-bp154.2.3.1 | Not reported | OPENSUSE-SU-2022:10222-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [eterm]Fixed
Details (2)
0.9.6-7· amd64 · bookwormFixed · Fixed:
0.9.6-6.1dsa · eterm · debian · bookworm; dsa · eterm · debian · 12
0.9.6-7· arm64 · bookwormFixed · Fixed:
0.9.6-6.1dsa · eterm · debian · bookworm; dsa · eterm · debian · 12
- [rxvt-unicode]Fixed
Source package: [rxvt-unicode]
Details (2)
9.30-2+b3· arm64 · bookwormFixed · Fixed:
9.22-11dsa · rxvt-unicode · debian · bookworm; dsa · rxvt-unicode · debian · 12
9.30-2+b4· amd64 · bookwormFixed · Fixed:
9.22-11dsa · rxvt-unicode · debian · bookworm; dsa · rxvt-unicode · debian · 12
[Debian 13 (Trixie)]
- [rxvt-unicode]Fixed
Source package: [rxvt-unicode]
Details (2)
9.31-3+b2· amd64 · trixieFixed · Fixed:
9.22-11dsa · rxvt-unicode · debian · 13
9.31-3+b2· arm64 · trixieFixed · Fixed:
9.22-11dsa · rxvt-unicode · debian · 13
[openSUSE Tumbleweed]
- [rxvt-unicode]Fixed
Source package: [rxvt-unicode]
Details (1)
9.31-3.15· x86_64 · tumbleweedFixed · Fixed:
9.30-2.1dsa · rxvt-unicode · opensuse · tumbleweed
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2022_10222-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2021-33477]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-33477]
- [https://osv.dev/vulnerability/DLA-2671-1]
- [https://osv.dev/vulnerability/DLA-2681-1]
- [https://osv.dev/vulnerability/DLA-2682-1]
- [https://osv.dev/vulnerability/DLA-2683-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-33477]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:10222-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12386-1]
- [https://security-tracker.debian.org/tracker/CVE-2021-33477]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-33477.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]