CVE-2024-37535

Publication date 9 June 2024

Last updated 19 August 2025

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

4.4 · Medium

Score breakdown

Description

GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476.

Read the notes from the security team

Status

Package Ubuntu Release Status
vte2.91 25.10 questing
Not affected
25.04 plucky
Not affected
24.10 oracular
Not affected
24.04 LTS noble
Fixed 0.76.0-1ubuntu0.1
23.10 mantic
Fixed 0.74.0-2ubuntu0.1
22.04 LTS jammy
Fixed 0.68.0-1ubuntu0.1
20.04 LTS focal
Fixed 0.60.3-0ubuntu1~20.5
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Notes

alexmurray

PoC in oss-security reply

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
vte2.91

Severity score breakdown

Parameter Value
Base score 4.4 · Medium
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Scope Unchanged
Confidentiality None
Integrity impact None
Availability impact High
Vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

Other references