Critical
Security advisory
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-27135
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:42 UTC · Revision 1
Source evidence
xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.
osv:CVE-2021-27135
Complete source record
{
"id": "54950e1ca63b07b35b2d0d5b67f24a4fe0690233f1f1f719526e7e9d0386ad1d",
"url": "https://osv.dev/vulnerability/CVE-2021-27135",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-27135",
"summary": "xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.",
"evidence": "osv:CVE-2021-27135",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-27135",
"aliases": [
"CVE-2021-27135"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/thomasdickey/xterm-snapshots",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f"
},
{
"fixed": "82ba55b8f994ab30ff561a347b82ea340ba7075c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:invisible-island:xterm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "366"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "82ba55b8f994ab30ff561a347b82ea340ba7075c"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"xterm-365c",
"xterm-365b",
"xterm-365a",
"xterm-365",
"xterm-364a",
"xterm-364",
"xterm-363g",
"xterm-363f",
"xterm-363e",
"xterm-363d",
"xterm-363c",
"xterm-363b",
"xterm-363a",
"xterm-363",
"xterm-362h",
"xterm-362g",
"xterm-362f",
"xterm-362e",
"xterm-362d",
"xterm-362c",
"xterm-362b",
"xterm-362a",
"xterm-362",
"xterm-361e",
"xterm-361d",
"xterm-361c",
"xterm-361b",
"xterm-361a",
"xterm-361",
"xterm-360e",
"xterm-360d",
"xterm-360c",
"xterm-360b",
"xterm-360a",
"xterm-360",
"xterm-359i",
"xterm-359h",
"xterm-359g",
"xterm-359f",
"xterm-359e",
"xterm-359d",
"xterm-359c",
"xterm-359b",
"xterm-359a",
"xterm-359",
"xterm-358g",
"xterm-358f",
"xterm-358e",
"xterm-358d",
"xterm-358c",
"xterm-358b",
"xterm-358a",
"xterm-358",
"xterm-357c",
"xterm-357b",
"xterm-357a",
"xterm-357",
"xterm-356l",
"xterm-356k",
"xterm-356j",
"xterm-356i",
"xterm-356h",
"xterm-356g",
"xterm-356f",
"xterm-356e",
"xterm-356d",
"xterm-356c",
"xterm-356b",
"xterm-356a",
"xterm-356",
"xterm-355a",
"xterm-355",
"xterm-354e",
"xterm-354d",
"xterm-354c",
"xterm-354b",
"xterm-354a",
"xterm-354",
"xterm-353q",
"xterm-353p",
"xterm-353o",
"xterm-353n",
"xterm-353m",
"xterm-353l",
"xterm-353k",
"xterm-353j",
"xterm-353i",
"xterm-353h",
"xterm-353g",
"xterm-353f",
"xterm-353e",
"xterm-353d",
"xterm-353c",
"xterm-353b",
"xterm-353a",
"xterm-353",
"xterm-352g",
"xterm-352f",
"xterm-352e",
"xterm-352d",
"xterm-352c",
"xterm-352b",
"xterm-352a",
"xterm-352",
"xterm-351l",
"xterm-351k",
"xterm-351j",
"xterm-351i",
"xterm-351h",
"xterm-351g",
"xterm-351f",
"xterm-351e",
"xterm-351d",
"xterm-351c",
"xterm-351b",
"xterm-351a",
"xterm-351",
"xterm-350g",
"xterm-350f",
"xterm-350e",
"xterm-350d",
"xterm-350c",
"xterm-350b",
"xterm-350a",
"xterm-350",
"xterm-349m",
"xterm-349l",
"xterm-349k",
"xterm-349j",
"xterm-349i",
"xterm-349h",
"xterm-349g",
"xterm-349f",
"xterm-349e",
"xterm-349d",
"xterm-349c",
"xterm-349b",
"xterm-349a",
"xterm-349",
"xterm-348m",
"xterm-348l",
"xterm-348k",
"xterm-348j",
"xterm-348i",
"xterm-348h",
"xterm-348g",
"xterm-348f",
"xterm-348e",
"xterm-348d",
"xterm-348c",
"xterm-348b",
"xterm-348a",
"xterm-348",
"xterm-347l",
"xterm-347k",
"xterm-347j",
"xterm-347i",
"xterm-347h",
"xterm-347g",
"xterm-347f",
"xterm-347e",
"xterm-347d",
"xterm-347c",
"xterm-347b",
"xterm-347a",
"xterm-347",
"xterm-346q",
"xterm-346p",
"xterm-346o",
"xterm-346n",
"xterm-346m",
"xterm-346l",
"xterm-346k",
"xterm-346j",
"xterm-346i",
"xterm-346h",
"xterm-346g",
"xterm-346f",
"xterm-346e",
"xterm-346d",
"xterm-346c",
"xterm-346b",
"xterm-346a",
"xterm-346",
"xterm-345d",
"xterm-345c",
"xterm-345b",
"xterm-345a",
"xterm-345",
"xterm-344v",
"xterm-344u",
"xterm-344t",
"xterm-344s",
"xterm-344r",
"xterm-344q",
"xterm-344p",
"xterm-344o",
"xterm-344n",
"xterm-344m",
"xterm-344l",
"xterm-344k",
"xterm-344j",
"xterm-344i",
"xterm-344h",
"xterm-344g",
"xterm-344f",
"xterm-344e",
"xterm-344d",
"xterm-344c",
"xterm-344b",
"xterm-344a",
"xterm-344",
"xterm-343i",
"xterm-343h",
"xterm-343g",
"xterm-343f",
"xterm-343e",
"xterm-343d",
"xterm-343c",
"xterm-343b",
"xterm-343a",
"xterm-343",
"xterm-342h",
"xterm-342g",
"xterm-342f",
"xterm-342e",
"xterm-342d",
"xterm-342c",
"xterm-342b",
"xterm-342a",
"xterm-342",
"xterm-341b",
"xterm-341a",
"xterm-341",
"xterm-340h",
"xterm-340g",
"xterm-340f",
"xterm-340e",
"xterm-340d",
"xterm-340c",
"xterm-340b",
"xterm-340a",
"xterm-340",
"xterm-339b",
"xterm-339a",
"xterm-339",
"xterm-338a",
"xterm-338",
"xterm-337s",
"xterm-337r",
"xterm-337q",
"xterm-337p",
"xterm-337o",
"xterm-337n",
"xterm-337m",
"xterm-337l",
"xterm-337k",
"xterm-337j",
"xterm-337i",
"xterm-337h",
"xterm-337g",
"xterm-337f",
"xterm-337e",
"xterm-337d",
"xterm-337c",
"xterm-337b",
"xterm-337a",
"xterm-337",
"xterm-336b",
"xterm-336a",
"xterm-336",
"xterm-335r",
"xterm-335q",
"xterm-335p",
"xterm-335o",
"xterm-335n",
"xterm-335m",
"xterm-335l",
"xterm-335k",
"xterm-335j",
"xterm-335i",
"xterm-335h",
"xterm-335g",
"xterm-335f",
"xterm-335e",
"xterm-335d",
"xterm-335c",
"xterm-335b",
"xterm-335a",
"xterm-335",
"xterm-334a",
"xterm-334",
"xterm-333zc",
"xterm-333zb",
"xterm-333za",
"xterm-333z",
"xterm-333y",
"xterm-333x",
"xterm-333w",
"xterm-333v",
"xterm-333u",
"xterm-333t",
"xterm-333s",
"xterm-333r",
"xterm-333q",
"xterm-333p",
"xterm-333o",
"xterm-333n",
"xterm-333m",
"xterm-333l",
"xterm-333k",
"xterm-333j",
"xterm-333i",
"xterm-333h",
"xterm-333g",
"xterm-333f",
"xterm-333e",
"xterm-333d",
"xterm-333c",
"xterm-333b",
"xterm-333a",
"xterm-333",
"xterm-332j",
"xterm-332i",
"xterm-332h",
"xterm-332g",
"xterm-332f",
"xterm-332e",
"xterm-332d",
"xterm-332c",
"xterm-332b",
"xterm-332a",
"xterm-331l",
"xterm-331k",
"xterm-331j",
"xterm-331i",
"xterm-331h",
"xterm-331g",
"xterm-331f",
"xterm-331e",
"xterm-331d",
"xterm-331c",
"xterm-331b",
"xterm-331a",
"xterm-331",
"xterm-330za",
"xterm-330z",
"xterm-330y",
"xterm-330x",
"xterm-330w",
"xterm-330v",
"xterm-330u",
"xterm-330t",
"xterm-330s",
"xterm-330r",
"xterm-330q",
"xterm-330p",
"xterm-330o",
"xterm-330n",
"xterm-330m",
"xterm-330l",
"xterm-330k",
"xterm-330j",
"xterm-330i",
"xterm-330h",
"xterm-330g",
"xterm-330f",
"xterm-330e",
"xterm-330d",
"xterm-330c",
"xterm-330b",
"xterm-330a",
"xterm-330",
"xterm-329i",
"xterm-329h",
"xterm-329g",
"xterm-329f",
"xterm-329e",
"xterm-329d",
"xterm-329c",
"xterm-329b",
"xterm-329a",
"xterm-329",
"xterm-328g",
"xterm-328f",
"xterm-328e",
"xterm-328d",
"xterm-328c",
"xterm-328b",
"xterm-328a",
"xterm-328",
"xterm-327zc",
"xterm-327zb",
"xterm-327za",
"xterm-327z",
"xterm-327y",
"xterm-327x",
"xterm-327w",
"xterm-327v",
"xterm-327u",
"xterm-327t",
"xterm-327s",
"xterm-327r",
"xterm-327q",
"xterm-327p",
"xterm-327o",
"xterm-327n",
"xterm-327m",
"xterm-327l",
"xterm-327k",
"xterm-327j",
"xterm-327i",
"xterm-327h",
"xterm-327g",
"xterm-327f",
"xterm-327e",
"xterm-327d",
"xterm-327c",
"xterm-327b",
"xterm-327a",
"xterm-327",
"xterm-326e",
"xterm-326d",
"xterm-326c",
"xterm-326b",
"xterm-326a",
"xterm-326",
"xterm-325j",
"xterm-325i",
"xterm-325h",
"xterm-325g",
"xterm-325f",
"xterm-325e",
"xterm-325d",
"xterm-325c",
"xterm-325b",
"xterm-325a",
"xterm-325",
"xterm-234h",
"xterm-324g",
"xterm-324f",
"xterm-324e",
"xterm-324d",
"xterm-324c",
"xterm-324b",
"xterm-324",
"xterm-323",
"xterm-322e",
"xterm-322d",
"xterm-322c",
"xterm-322b",
"xterm-322a",
"xterm-322",
"xterm-321",
"xterm-320f",
"xterm-320e",
"xterm-320d",
"xterm-320c",
"xterm-320b",
"xterm-320a",
"xterm-320",
"xterm-319b",
"xterm-319a",
"xterm-319",
"xterm-318i",
"xterm-318h",
"xterm-318g",
"xterm-318f",
"xterm-318e",
"xterm-318d",
"xterm-318c",
"xterm-318b",
"xterm-317-ross26-6",
"xterm-318a",
"xterm-317-ross26-5",
"xterm-318",
"xterm317c",
"xterm-317b",
"xterm-317a",
"xterm-317",
"xterm-316c",
"xterm-316b",
"xterm-316a",
"xterm-316",
"xterm-315c",
"xterm-315b",
"xterm-315a",
"xterm-315",
"xterm-314m",
"xterm-314l",
"xterm-314k",
"xterm-314j",
"xterm-314i",
"xterm-314h",
"xterm-314g",
"xterm-314f",
"xterm-314e",
"xterm-314d",
"xterm-314c",
"xterm-314b",
"xterm-314a",
"xterm-314",
"xterm-313k",
"xterm-313j",
"xterm-313i",
"xterm-313h",
"xterm-313g",
"xterm-313f",
"xterm-313e",
"xterm-313d",
"xterm-313c",
"xterm-313b",
"xterm-313a",
"xterm-313",
"xterm-312j",
"xterm-312i",
"xterm-312h",
"xterm-312g",
"xterm-312f",
"xterm-312e",
"xterm-312d",
"xterm-312c",
"xterm-312b",
"xterm-312a",
"xterm-312",
"xterm-311a",
"xterm-311",
"xterm-310g",
"xterm-310f",
"xterm-310e",
"xterm-310d",
"xterm-310c",
"xterm-310b",
"xterm-310a",
"xterm-310",
"xterm-309e",
"xterm-309d",
"xterm-309c",
"xterm-309b",
"xterm-309a",
"xterm-309",
"xterm-308d",
"xterm-308c",
"xterm-308b",
"xterm-308a",
"xterm-308",
"xterm-307b",
"xterm-307a",
"xterm-307",
"xterm-306i",
"xterm-306h",
"xterm-306g",
"xterm-306f",
"xterm-306e",
"xterm-306d",
"xterm-306c",
"xterm-306b",
"xterm-306a",
"xterm-306",
"xterm-305a",
"xterm-305",
"xterm-304l",
"xterm-304k",
"xterm-304j",
"xterm-304i",
"xterm-304h",
"xterm-304g",
"xterm-304f",
"xterm-304e",
"xterm-304d",
"xterm-304c",
"xterm-304b",
"xterm-304a",
"xterm-304",
"xterm-303o",
"xterm-303n",
"xterm-303m",
"xterm-303l",
"xterm-303k",
"xterm-303j",
"xterm-303i",
"xterm-303h",
"xterm-303f",
"xterm-303e",
"xterm-303d",
"xterm-303c",
"xterm-303b",
"xterm-303a",
"xterm-302c",
"xterm-302b",
"xterm-302",
"xterm-301i",
"xterm-301h",
"xterm-301g",
"xterm-301f",
"xterm-301e",
"xterm-301d",
"xterm-301c",
"xterm-301b",
"xterm-301a",
"xterm-301",
"xterm-300i",
"xterm-300h",
"xterm-300g",
"xterm-300f",
"xterm-300e",
"xterm-300d",
"xterm-300c",
"xterm-300b",
"xterm-300a",
"xterm-300",
"xterm-299",
"xterm-298a",
"xterm-298",
"xterm-297j",
"xterm-297i",
"xterm-297h",
"xterm-297g",
"xterm-297f",
"xterm-297e",
"xterm-297d",
"xterm-297c",
"xterm-297b",
"xterm-297a",
"xterm-297",
"xterm-296n",
"xterm-296m",
"xterm-296l",
"xterm-296k",
"xterm-296j",
"xterm-296i",
"xterm-296h",
"xterm-296g",
"xterm-296f",
"xterm-296e",
"xterm-296d",
"xterm-296c",
"xterm-296b",
"xterm-296a",
"xterm-296",
"xterm-295a",
"xterm-295",
"xterm-294",
"xterm-293h",
"xterm-293g",
"xterm-293f",
"xterm-293e",
"xterm-293c",
"xterm-293b",
"xterm-293a",
"xterm-293-sixel3",
"xterm-293-sixel2",
"xterm-293-sixel1",
"xterm-293",
"xterm-292g",
"xterm-292f",
"xterm-292e",
"xterm-292d",
"xterm-292c",
"xterm-292b",
"xterm-292a",
"xterm-292",
"xterm-291h",
"xterm-291g",
"xterm-291f",
"xterm-291e",
"xterm-291d",
"xterm-291c",
"xterm-291a",
"xterm-291",
"xterm-290",
"xterm-289",
"xterm-288g",
"xterm-288f",
"xterm-288e",
"xterm-288d",
"xterm-288c",
"xterm-288b",
"xterm-288a",
"xterm-288",
"xterm-287j",
"xterm-287i",
"xterm-287h",
"xterm-287g",
"xterm-287f",
"xterm-287e",
"xterm-287d",
"xterm-287b",
"xterm-287a",
"xterm-287",
"xterm-286f",
"xterm-286e",
"xterm-286d",
"xterm-286c",
"xterm-286b",
"xterm-286a",
"xterm-286",
"xterm-278c",
"xterm-285c",
"xterm-285b",
"xterm-285a",
"xterm-285",
"xterm-284b",
"xterm-284a",
"xterm-284",
"xterm-283b",
"xterm-283a",
"xterm-283",
"xterm-282d",
"xterm-282c",
"xterm-282b",
"xterm-282a",
"xterm-282",
"xterm-281s",
"xterm-281r",
"xterm-281q",
"xterm-281p",
"xterm-281o",
"xterm-281n",
"xterm-281m",
"xterm-281l",
"xterm-281k",
"xterm-281j",
"xterm-281i",
"xterm-281h",
"xterm-281g",
"xterm-281f",
"xterm-281e",
"xterm-281d",
"xterm-281c",
"xterm-218b",
"xterm-281a",
"xterm-281",
"xterm-280",
"xterm-279g",
"xterm-279f",
"xterm-279e",
"xterm-279d",
"xterm-279c",
"xterm-279b",
"xterm-279a",
"xterm-279",
"xterm-278l",
"xterm-278k",
"xterm-278j",
"xterm-278i",
"xterm-278h",
"xterm-278g",
"xterm-278f",
"xterm-278d",
"xterm-278b",
"xterm-278a",
"xterm-278",
"xterm-277b",
"xterm-277",
"xterm-276q",
"xterm-276p",
"xterm-276o",
"xterm-276n",
"xterm-276m",
"xterm-276l",
"xterm-276k",
"xterm-276j",
"xterm-276i",
"xterm-276h",
"xterm-276g",
"xterm-276f",
"xterm-276e",
"xterm-276d",
"xterm-276c",
"xterm-276b",
"xterm-276a",
"xterm-276",
"xterm-275e",
"xterm-275d",
"xterm-275c",
"xterm-275b",
"xterm-275a",
"xterm-275",
"xterm-274c",
"xterm-274b",
"xterm-274a",
"xterm-274",
"xterm-273e",
"xterm-273d",
"xterm-273c",
"xterm-273b",
"xterm-273a",
"xterm-273",
"xterm-272",
"xterm-271j",
"xterm-271i",
"xterm-271h",
"xterm-271g",
"xterm-271f",
"xterm-271e",
"xterm-271d",
"xterm-271c",
"xterm-271b",
"xterm-271a",
"xterm-271",
"xterm-270p",
"xterm-270o",
"xterm-270n",
"xterm-270m",
"xterm-270l",
"xterm-270k",
"xterm-270j",
"xterm-270i",
"xterm-270h",
"xterm-270g",
"xterm-270f",
"xterm-270e",
"xterm-270d",
"xterm-270c",
"xterm-270b",
"xterm-270a",
"xterm-270",
"xterm-269j",
"xterm-269i",
"xterm-269h",
"xterm-269g",
"xterm-269f",
"xterm-269e",
"xterm-269d",
"xterm-269c",
"xterm-269b",
"xterm-269a",
"xterm-269",
"xterm-268f",
"xterm-268e",
"xterm-268d",
"xterm-268c",
"xterm-268b",
"xterm-268",
"xterm-267h",
"xterm-267g",
"xterm-267f",
"xterm-267e",
"xterm-267d",
"xterm-267c",
"xterm-267b",
"xterm-267a",
"xterm-267",
"xterm-266f",
"xterm-266e",
"xterm-266d",
"xterm-266c",
"xterm-266b",
"xterm-266a",
"xterm-266",
"xterm-265b",
"xterm-265a",
"xterm-265",
"xterm-264b",
"xterm-264a",
"xterm-264",
"xterm-263",
"xterm-262d",
"xterm-262c",
"xterm-262b",
"xterm-262a",
"xterm-262",
"xterm-261e",
"xterm-261d",
"xterm-261c",
"xterm-261b",
"xterm-261a",
"xterm-261",
"xterm-260",
"xterm-259f",
"xterm-259e",
"xterm-259d",
"xterm-259c",
"xterm-259b",
"xterm-259a",
"xterm-259",
"xterm-258h",
"xterm-258g",
"xterm-258f",
"xterm-258e",
"xterm-258d",
"xterm-258c",
"xterm-258b",
"xterm-258a",
"xterm-258",
"xterm-257",
"xterm-256o",
"xterm-256n",
"xterm-256m",
"xterm-256l",
"xterm-256k",
"xterm-256j",
"xterm-256i",
"xterm-256h",
"xterm-256g",
"xterm-256f",
"xterm-256e",
"xterm-256d",
"xterm-256c",
"xterm-256b",
"xterm-256a",
"xterm-256",
"xterm-255c",
"xterm-255b",
"xterm-255a",
"xterm-255",
"xterm-254d",
"xterm-254c",
"xterm-254b",
"xterm-254a",
"xterm-254",
"xterm-253j",
"xterm-253i",
"xterm-253h",
"xterm-253g",
"xterm-253f",
"xterm-253e",
"xterm-253d",
"xterm-253c",
"xterm-253b",
"xterm-253a",
"xterm-253",
"xterm-252c",
"xterm-252b",
"xterm-252a",
"xterm-252",
"xterm-251l",
"xterm-251k",
"xterm-251j",
"xterm-251i",
"xterm-251h",
"xterm-251g",
"xterm-251f",
"xterm-235b",
"xterm-251e",
"xterm-251d",
"xterm-251c",
"xterm-251b",
"xterm-251a",
"xterm-251",
"xterm-250f",
"xterm-250e",
"xterm-250d",
"xterm-250c",
"xterm-250b",
"xterm-250a",
"xterm-250",
"xterm-249c",
"xterm-249b",
"xterm-249a",
"xterm-249",
"xterm-248h",
"xterm-248g",
"xterm-248f",
"xterm-248e",
"xterm-248d",
"xterm-248c",
"xterm-248b",
"xterm-248a",
"xterm-248",
"xterm-247c",
"xterm-247b",
"xterm-247a",
"xterm-247",
"xterm-246b",
"xterm-246a",
"xterm-246",
"xterm-245c",
"xterm-245b",
"xterm-245a",
"xterm-245",
"xterm-244",
"xterm-243w",
"xterm-243v",
"xterm-243u",
"xterm-243t",
"xterm-243s",
"xterm-243r",
"xterm-243q",
"xterm-243p",
"xterm-243o",
"xterm-243n",
"xterm-243m",
"xterm-243l",
"xterm-243k",
"xterm-243j",
"xterm-243i",
"xterm-243h",
"xterm-243g",
"xterm-247f",
"xterm-243e",
"xterm-243d",
"xterm-243c",
"xterm-243",
"xterm-242d",
"xterm-242c",
"xterm-242b",
"xterm-242a",
"xterm-242",
"xterm-241g",
"xterm-241f",
"xterm-241e",
"xterm-241d",
"xterm-241c",
"xterm-241b",
"xterm-241a",
"xterm-241",
"xterm-240",
"xterm-239c",
"xterm-239",
"xterm-238",
"xterm-237c",
"xterm-237b",
"xterm-237a",
"xterm-237",
"xterm-236c",
"xterm-236b",
"xterm-236a",
"xterm-236",
"xterm-235d",
"xterm-235c",
"xterm-235a",
"xterm-235",
"xterm-234d",
"xterm-234c",
"xterm-234b",
"xterm-234",
"xterm-233b",
"xterm-233a",
"xterm-233",
"xterm-232b",
"xterm-232a",
"xterm-232",
"xterm-231i",
"xterm-231g",
"xterm-231f",
"xterm-231e",
"xterm-231d",
"xterm-231c",
"xterm-231b",
"xterm-231a",
"xterm-231",
"xterm-230a",
"xterm-230",
"xterm-229o",
"xterm-229n",
"xterm-229m",
"xterm-229l",
"xterm-229k",
"xterm-229j",
"xterm-229i",
"xterm-229h",
"xterm-229g",
"xterm-229f",
"xterm-229e",
"xterm-229d",
"xterm-229c",
"xterm-229b",
"xterm-229a",
"xterm-229",
"xterm-228a",
"xterm-228",
"xterm-227i",
"xterm-227h",
"xterm-227g",
"xterm-227f",
"xterm-227e",
"xterm-227d",
"xterm-227c",
"xterm-227b",
"xterm-227a",
"xterm-227",
"xterm-226d",
"xterm-226c",
"xterm-226b",
"xterm-226a",
"xterm-226",
"xterm-225n",
"xterm-225m",
"xterm-225l",
"xterm-225k",
"xterm-225j",
"xterm-225i",
"xterm-225h",
"xterm-225g",
"xterm-225f",
"xterm-225e",
"xterm-225d",
"xterm-225",
"xterm-224",
"xterm-223e",
"pre-cachedGCs",
"xterm-223",
"xterm-222",
"xterm-221",
"xterm-220",
"xterm-219",
"xterm-218",
"xterm-217",
"xterm-216",
"xterm-215",
"xterm-214",
"xterm-213",
"xterm-212",
"xterm-211",
"xterm-210",
"xterm-209",
"xterm-208",
"xterm-207",
"xterm-206",
"xterm-205",
"xterm-204c",
"xterm-204",
"xterm-203",
"xterm-202h",
"xterm-202g",
"xterm-202f",
"xterm-202",
"xterm-201",
"xterm-200",
"xterm-199",
"xterm-198",
"xterm-197",
"xterm-196",
"xterm-195",
"xterm-194",
"xterm-193",
"xterm-192",
"xterm-191",
"xterm-190",
"xterm-189",
"xterm-188",
"xterm-187",
"xterm-186",
"xterm-185",
"xterm-184",
"xterm-183",
"xterm-182",
"xterm-181",
"xterm-180",
"xterm-179",
"xterm-178",
"xterm-177",
"xterm-176",
"xterm-175",
"xterm-174",
"xterm-173",
"xterm-172",
"xterm-171",
"xterm-170",
"xterm-169",
"xterm-168",
"xterm-167",
"xterm-166",
"xterm-165",
"xterm-164",
"xterm-163",
"xterm-162",
"xterm-161",
"xterm-160",
"xterm-159",
"xterm-158",
"xterm-157",
"xterm-156",
"xterm-155",
"xterm-154",
"xterm-153",
"xterm-152",
"xterm-151",
"xterm-150",
"xterm-149",
"XFree86-4_0_1e",
"xterm-148",
"XFree86-4_0_1d",
"xterm-147",
"xterm-146",
"xterm-145",
"XFree86-4_0_1c",
"xterm-144",
"xterm-143",
"xterm-142",
"xterm-141",
"xterm-140",
"xterm-139",
"XFree86-4_0d",
"xterm-138",
"XFree86-4_0c",
"xterm-137",
"xterm-136",
"xterm-135",
"xterm-134",
"XFree86-4_0b",
"xterm-133",
"xterm-132",
"xterm-131",
"xterm-130",
"xterm-129",
"XFree86-3_9_18",
"xterm-128",
"XFree86-3_9_17f",
"xterm-127",
"XFree86-3_9_17e",
"xterm-126",
"xterm-125",
"xterm-124",
"xterm-123",
"XFree86-3_9_17a",
"XFree86-3_9_17",
"xterm-122",
"XFree86-3_9_16d",
"xterm-121",
"xterm-120",
"xterm-119",
"xterm-118",
"xterm-117",
"XFree86-3_9_16b",
"xterm-116",
"xterm-115",
"xterm-114",
"XFree86-3_9_15c",
"xterm-113",
"XFree86-3_9_15",
"xterm-112",
"XFree86-3_9Px",
"xterm-111",
"XFree86-3_9Pv",
"xterm-110",
"xterm-109",
"xterm-108",
"XFree86-3_9Ps",
"xterm-107",
"xterm-106",
"XFree86-3_9Pq",
"xterm-105",
"xterm-104",
"XFree86-3_9Pn",
"xterm-103",
"xterm-102",
"xterm-101",
"xterm-100",
"xterm-99",
"xterm-98",
"xterm-97",
"xterm-96",
"XFree86-3_9Pi",
"xterm-95",
"XFree86-3_9Pg",
"xterm-94",
"XFree86-3_9Pe",
"xterm-93",
"XFree86-3_9P",
"xterm-92",
"XFree86-3_9Nz",
"XFree86-3_9Nx",
"xterm-91",
"XFree86-3_9Ns",
"xterm-90",
"XFree86-3_9Nn",
"xterm-89",
"XFree86-3_9Nl",
"xterm-88",
"XFree86-3_9Nk",
"xterm-87",
"xterm-86",
"xterm-85",
"xterm-84",
"XFree86-3_9Nc",
"xterm-83",
"XFree86-3_9Nb",
"xterm-82",
"xterm-81",
"XFree86-3_9Aj",
"xterm-80",
"xterm-79",
"XFree86-3_9Ai",
"xterm-78",
"xterm-77",
"xterm-76",
"xterm-75",
"XFree86-3_9Ah",
"xterm-74",
"xterm-73",
"xterm-72",
"xterm-71",
"XFree86-3_9Ag",
"xterm-70",
"XFree86-3_9Af",
"xterm-69",
"xterm-67",
"xterm-66",
"xterm-65",
"xterm-64",
"xterm-63",
"XFree86-3_9Ad",
"xterm-62",
"xterm-61",
"XFree86-3_9Ac",
"xterm-60",
"xterm-59",
"xterm-58",
"XFree86-3_9Ab",
"xterm-57",
"XFree86-3_9y",
"xterm-56",
"xterm-55",
"XFree86-3_9w",
"XFree86-3_9t",
"xterm-54",
"XFree86-3_9s",
"xterm-53",
"xterm-52",
"XFree86-3_9q",
"xterm-51",
"XFree86-3_9n",
"xterm-50",
"XFree86-3_9m",
"xterm-49",
"XFree86-3_9k",
"xterm-48",
"xterm-47",
"xterm-46",
"xterm-45",
"xterm-44",
"xterm-43",
"xterm-42",
"xterm-41",
"xterm-40",
"XFree86-3_3",
"XFree86-3_2A",
"X11R6_3rel",
"XFree86-3_2",
"XFree86-3_1_2G",
"XFree86-3_1_2F",
"XFree86-3_1_2E",
"X11R6_1rel",
"X11R5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-27135.json",
"vanir_signatures": [
{
"id": "CVE-2021-27135-0de5f20f",
"digest": {
"length": 5505,
"function_hash": "127070465904715510616392304427124691562"
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "misc.c",
"function": "do_osc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-2a160ccb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"280709191846888646550698681540738961659",
"226705682114956398685846114735549955514",
"252451151152915977382280230916467996104",
"10135954149745406975362795339274391879",
"277590772243710789756231888917625886159",
"174385177254667704275054183006727246373",
"53974488310248005238152084537436460795",
"173589553026532778298841178527036107948",
"245376495834198285527382064015999749958",
"173086633510014195517003102476589093628",
"126134250880498267035722584537690813561",
"246935202716737391353200169750233309647",
"25488849075141521268775484257805824636",
"142483252976579474851934010566698720908",
"139861737739641820012893465514109610676",
"35336434664662403871308513023694792412",
"336722215932442192283583105186864187245",
"42610278977366364618731082774493205441",
"173935868830782842580687563221739320419",
"132646632278475381123183588689971022165",
"35528415697002637027048522596005520673",
"163896385807631309978555388515950618758",
"270749469705006858191819603330399319679",
"251086218256038773859123398299384091817",
"327814840434038343724647610298853355992",
"125318047365383961727906368687703028462",
"89364007982166668024592249696500602280",
"76345595754548076663452169411992688972",
"142237196402299753189105093320171887227",
"112462427709371277111883341953802868737",
"251751322705141133425265816393336719150",
"44181428827550637318129757331949376420",
"138583554742635123225587885490227240973",
"296347859757246977399321637291842699382",
"331112228688638702530361708818265249764",
"44804556427582153993162990961399443689",
"255075705172259867202060680002642899053",
"242201102045282095816070014016665359051",
"161504014374521074827468553238823683406",
"62167224929021692133398291641577335640",
"97792576252762103858176673296455761552",
"188518386540423457082943321359692898803",
"4010030047529690650657161002237509387",
"170429844822433222019863638475692183976",
"265642429328231205355322352150396228864",
"566120155691844787083730886144405939",
"318781887252173086121049918804735720421",
"288760628316193800053746590455149468151",
"31001497096229790573543894970126459707",
"81629981202481641297688391414516636433",
"121158407101533118064873197736492790259",
"328949005260222758869859776995115540211",
"95803741572572839564073036712838260904",
"178936421502492694060234835568300898361",
"130799906630688719493223679374798669717",
"172139263653526526245267282958032138394",
"44028362625048614664140459644367332830",
"64643268354849795983592409872499113300",
"122274706139804331759796242852332387472",
"112467043421239801377616973728905961372",
"173190449677022640434018764058112020820",
"292648278138743617897745305703950416350",
"253643342136526512846268874806508528014",
"333978298987779596323201183069626701489",
"216271558675049484966825530321862216406",
"126586841998529848930115536787431908975",
"74195884169200568559979400402491829655",
"219554785980094828698571268163678268141",
"234094167595483306867763415226646486640",
"272258221669919149943668383096599983356",
"188151475264752820104339306277638615008",
"168864237646517475504032317660512803681",
"211190162928353430486334285500308467021",
"68006722170955113957990986971196745822",
"202170362119682739512248022105016137546",
"90183885948604087333555714557401408415",
"225713318487517140581097520855122642583",
"20779807987129472637393645037935954467",
"8555656639096673522124277596235780768",
"107848635794427224205086204070887237157",
"55607047985036484036875784247285761191",
"19407283166991346465733764266579362668",
"269831868574013710387532245517662641913",
"305873431664383801242991232791794894259",
"119690949727642525870798466532460136562",
"115674793925800716433111584148518256067",
"42388429598614212417229567592697135908",
"27686782013739405594270920347072748656",
"200503559919357271827110291412716128119",
"202072486762941197433772872420492429506",
"320568157561534497948807577240281571807",
"297141469878859343758252897636692040847",
"295050438991641194704303978579421242000",
"7779604003790456517600010536715191169",
"53989348763585805394653215705198856161",
"105525445379191043382632706209937292420",
"130200154395047468222393443248673822842",
"27415475902297350147583370932308424672",
"49772709835657089767198105488361424477",
"216467639844748230019343895018497927264",
"75407180318704451699303769443305508093",
"90477121491718072060675061028638773452",
"191030403299871298014566886997312975349",
"91897649930860484013527677932862903122",
"221557650087221816721450107098278273776",
"314182889167994855520297096869940242060",
"233742460839799911164694397791771787804",
"92992936326423504256595606335022989156",
"76150989215642726683055508043933882294",
"297351737832971894903132365115813047057",
"46407220122534395588725652540513742479",
"162715171557179896394990430410557061413",
"238304738011719532965800634373990047382",
"302022918288066779705265462234806472579",
"50454500332394559061493709160560951513",
"132862363900470642506475538916476013541",
"117275589977115262562043201440625547685",
"240179583190321960351791869679455866464",
"308354752515490222436564410869102882039",
"73146341374928373682985806236359380466",
"23100321799526649971876323936718951404",
"286380862032246547213927278484022572308",
"186312216781839157033853547843247766171",
"278111340395685396375904314703291508756",
"276747299094217873686489012647527382964",
"239129070115456954964455470179078691136",
"94568802784762704550233800450964626976",
"230277815541096321488591233567837510974"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "charproc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-2a5bafd1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"204929593908884127775469947004160956522",
"131684641695888650661256718546890082159",
"126809655382010135009867701658079097622",
"156776681246202259308070176035265963334",
"326289920574651518901024125105438327443"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "util.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-4543587d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32796789806284024275639916408541358210",
"197224394363200850893404218805619087214",
"230267144874948808801123221530937563224",
"89732657109155903477984755739502864958"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-49faaa99",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199534115992065564062393482320705016279",
"304203568142421823906187627845949395047",
"317617454335689720228507120511803656060",
"107654739791241878775791045606133387624",
"35491446974216053249343433928397806785",
"122953575330822752808876735713250609564",
"252379642032017967221479357510032159835",
"132964942495668331078005948237477484694",
"247978921328329023575986872304006956809",
"204893840609433687165312711662396160191",
"86808312559954287772236679031657804377"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "xterm.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-5b2fd9fd",
"digest": {
"length": 472,
"function_hash": "47534819152559570497781849344156927115"
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "misc.c",
"function": "xtermDisplayCursor"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-97215443",
"digest": {
"threshold": 0.9,
"line_hashes": [
"72694500207652297460808975945920711998",
"237277466881759296733375356513690493662",
"132372491384466679160873286837148254468",
"25642798928886029874802640767733127514",
"164099848433969166646613279799361929758",
"11014560221248064822611044629765564826",
"166189383573761758535097672793290215162",
"292855935639810985574292297011019046247",
"242588665069743278023405742694201145802",
"335841484031831615446560039007916277002",
"279375914903389234077515323111672098760",
"35249907194928438438649930394979921809",
"199419639856679820078998993453425914001",
"294715299407343097179856512219342483653",
"124300979861186525391169235801636455666",
"273090677168433207561407823756685399475",
"320282322418498883705653542003546244001",
"904214065557976163728780212774673152",
"272616020005234441870020148691686446685",
"64350548646897784199941918243033906684",
"322791353177174351544891449059044585802",
"131108580668779217662110309791956931455",
"10586811697175077733522694352235028330",
"62939959249465580221867296832178140075",
"212124477098067225793221045248986250543",
"120157485888596235695887349082134428958",
"232409331780280012946627685493404962739",
"155265610836499417979603110690304762676",
"43646782729099435162389060024828976552",
"39621670562495537492485562899984857698",
"2385508016753122030196617902617345398",
"272612776165544630405170437683837471556",
"333066387766028434900340732608904101606",
"317678915728580348284282405075548053451",
"2570133880513437493917470134510619628"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "misc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-a2bc9fb9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277148843522247792063794214364607991703",
"16818336402220346127488010570367314038",
"323236449147721195249215930107085499439",
"297085073382815427472032307678603587892",
"74882116455560791166794663649655751526",
"325103990340651829762690253465184086568",
"203997351473975185562593409991130104445",
"215591782777490406855907464249939362306",
"15713256378289495295718885869035554783",
"153906715426697823211501509374258167069",
"155637593777033425502821384904868628191",
"307720885783947251490436529083262210094",
"323820652969859190218317359477985534990",
"101295488949237601696279946418004577908",
"99940377818103097677378623059282468999"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c",
"target": {
"file": "button.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-a96ff95e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323128627578147688109374271103488750544",
"55011328144653014196309963490386341495",
"174647039267080340667723307985374464576",
"253745108644445579663293773628509748856",
"284346489832229756364550425661057521884",
"127108674938365114279541143415763451261",
"273483264447646730812749789235149892426",
"89054066494610616194240864867014990756",
"312784913356344527860258683952786130238",
"83234689361834355370391707682737808410",
"338580243167605740160088853352923993522",
"47552319049112998642253747127800896038",
"172384635736661599305534344939471289138"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "ptyx.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-d2798a8b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"226705682114956398685846114735549955514",
"284728283629381026560432301225281944672",
"241608671915037702564816113690035224637",
"323570788994934141974789437038625720627"
]
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "Tekproc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-e089fda2",
"digest": {
"length": 10120,
"function_hash": "163015194264236923837560198250029256481"
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/a8fc74f3bcca38d5a288c9947f3e9d48868a3a3f",
"target": {
"file": "charproc.c",
"function": "VTRealize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-27135-f415546d",
"digest": {
"length": 2116,
"function_hash": "98433897814228501755533246292104164193"
},
"source": "https://github.com/thomasdickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c",
"target": {
"file": "button.c",
"function": "SaltTextAway"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:17:20Z"
}
}
],
"modified": "2026-10-20T14:17:20.146798985Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/",
"https://access.redhat.com/security/cve/CVE-2021-27135",
"https://invisible-island.net/xterm/xterm.log.html",
"https://lists.debian.org/debian-lts-announce/2021/02/msg00019.html",
"https://security.gentoo.org/glsa/202208-22",
"https://www.openwall.com/lists/oss-security/2021/02/09/7",
"https://www.openwall.com/lists/oss-security/2021/02/09/9",
"https://bugzilla.redhat.com/show_bug.cgi?id=1927559",
"https://bugzilla.suse.com/show_bug.cgi?id=1182091",
"https://news.ycombinator.com/item?id=26524650",
"https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075c"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "33"
},
{
"last_affected": "33"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-27135",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388777,
"published_at": "2021-02-10T16:15:13.787+00:00"
}