CVE-2008-1142: Aterm

Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days.

rxvt 2.6.4 opens a terminal window on :0 if the DISPLAY environment variable is not set, which might allow local users to hijack X11 connections. NOTE: it was later reported that rxvt-unicode, mrxvt, aterm, multi-aterm, and wterm are also affected. NOTE: realistic attack scenarios require that the victim enters a command on the wrong machine.

Affected products

• Aterm Aterm: up to and including 1.0.0; version 0.1.0 only; version 0.1.1 only; version 0.2.0 only; version 0.3.0 only; version 0.3.1 only; …
• Eterm Eterm: up to and including 0.9.3; version 0.9.2 only
• Mrxvt Mrxvt: up to and including 0.5.2; version 0.4.2 only
• Multi-Aterm Multi-Aterm: up to and including 0.2; version 0.0.1 only; version 0.0.3 only; version 0.0.4 only; version 0.0.5 only; version 0.1 only
• Rxvt Rxvt: up to and including 2.7.9; version 2.6.1 only; version 2.6.2 only; version 2.6.3 only; version 2.6.4 only; version 2.7.5 only; …
• Rxvt-Unicode Rxvt-Unicode: up to and including 9.01; version 1.0 only; version 1.1 only; version 1.2 only; version 1.3 only; version 1.4 only; …
• Wterm Wterm: up to and including 6.2.8a2; version 6.2.5 only; version 6.2.6 only

Published 2008-04-07. Last modified 2026-06-16.