VDB
CVE-2019-9535
CVE-2019-9535
PUBLISHED
CVSS 10 CRITICAL
A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.
EPSS 3.97% · 88.6th percentile
Risk Scores
CVSS 2.0
10
EPSS Score
3.97%
88.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| iterm2 | iterm2 | 0 |
| iTerm2 | iTerm2 | 3.3.5 |
Timeline
- Oct 9, 2019 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Mar 11, 2023 EPSS Score
References
- VU#763073 third-party-advisory
- https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit/ url
- https://groups.google.com/forum/#%21topic/iterm2-discuss/57k_AuLdQa4 url
- https://nvd.nist.gov/vuln/detail/CVE-2019-9535 advisory
- https://blog.mozilla.org/security/2019/10/09/iterm2-critical-issue-moss-audit url
- https://groups.google.com/forum/#!topic/iterm2-discuss/57k_AuLdQa4 url
- https://kb.cert.org/vuls/id/763073 url