Vulnerability Details CVE-2024-38395
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
Exploit prediction scoring system (EPSS) score
EPSS Score 0.057
EPSS Ranking 90.0%
CVSS Severity
CVSS v3 Score 9.8
References
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
- https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
- https://iterm2.com/downloads.html
- https://www.openwall.com/lists/oss-security/2024/06/15/1
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
- https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
- https://iterm2.com/downloads.html
- https://www.openwall.com/lists/oss-security/2024/06/15/1