CVE-2024-38395
CRITICAL 9.8EPSS 1.5%
In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."
- CVSS v3.1 CNA
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.48% chance of exploitation in the next 30 days, 74th percentile
- Published
- 2024-06-16
- Updated
- 2024-08-02
Proof-of-concept exploits (1)
- vin01/poc-cve-2024-3839619★ · 2024-06-16
Security advisories
- http://www.openwall.com/lists/oss-security/2024/06/17/1
- https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
- https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
- https://iterm2.com/downloads.html