Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fix two possible attack vectors, where an attacker can store
information into the termianl and then get to replay it. Two of those instances are setting the terminal title, and icon title, and then requesting the values back (see CVE-2003-0063[2] and https://marc.info/?l=bugtraq&m=104612710031920&w=2 for details). And another case is sending an invalid DECRQSS sequence, which the handler would respond back with the results, see here for how this is used: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030 CVE-2008-2383[3] These bugs were found and disclosed by David Leadbeater <dgl@dgl.cx> (@dgl at github.com)
- Loading branch information