CVE catalog

CVE-2023-40359

xterm: CVE-2023-40359

[CVE catalog]

Severity
Low · CVSS 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.85% · Oct 25, 2026

xterm before 380 supports ReGIS reporting for character-set names even if they have unexpected characters (i.e., neither alphanumeric nor underscore), aka a pointer/overflow issue. This can only occur for xterm installations that are configured at compile time to use a certain experimental feature.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxtermsid412-1fixed
Debianxtermforky412-1fixed
Debianxtermtrixie398-1fixed
Debianxtermbookworm379-1vulnerable
Susextermlinux enterprise module for basesystem 15 sp4330-150200.11.12.1fixed
Susextermlinux enterprise module for basesystem 15 sp5330-150200.11.12.1fixed
Susextermmanager proxy 4.2330-150200.11.12.1fixed
Susextermmanager server 4.2330-150200.11.12.1fixed
Opensusextermleap 15.4330-150200.11.12.1fixed
Opensusextermleap 15.5330-150200.11.12.1fixed
Opensusextermtumbleweed384-2.1fixed
Ubuntuxterm16.04318-2ubuntu1vulnerable
Ubuntuxterm16.04318-2ubuntu2vulnerable
Ubuntuxterm16.04322-1ubuntu1vulnerable
Ubuntuxterm16.04322-1ubuntu1.2vulnerable
Ubuntuxterm18.04324-2ubuntu1vulnerable
Ubuntuxterm18.04330-1ubuntu1vulnerable
Ubuntuxterm18.04330-1ubuntu2vulnerable
Ubuntuxterm18.04330-1ubuntu2.2vulnerable
Ubuntuxterm20.04348-2ubuntu1vulnerable
Ubuntuxterm20.04353-1ubuntu1vulnerable
Ubuntuxterm20.04353-1ubuntu1.20.04.2vulnerable
Ubuntuxterm22.04366-1ubuntu1vulnerable
Ubuntuxterm22.04369-1ubuntu1vulnerable
Ubuntuxterm22.04370-1ubuntu1vulnerable
Ubuntuxterm22.04370-2ubuntu1vulnerable
Ubuntuxterm22.04371-1ubuntu1vulnerable
Ubuntuxterm22.04372-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxtermsourcesid382-2unimportantNot reportedNot reported
Debianxtermsourceforky382-2unimportantNot reportedNot reported
Debianxtermsourcetrixie382-2unimportantNot reportedNot reported
Debianxtermsourcebookworm(unfixed)unimportantNot reportedNot reported
Susextermrpmlinux enterprise module for basesystem 15 sp4330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Susextermrpmlinux enterprise module for basesystem 15 sp5330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Susextermrpmmanager proxy 4.2330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Susextermrpmmanager server 4.2330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Opensusextermrpmleap 15.4330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Opensusextermrpmleap 15.5330-150200.11.12.1Not reportedSUSE-SU-2023:4438-1Not reported
Opensusextermrpmtumbleweed384-2.1Not reportedOPENSUSE-SU-2024:13240-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]