Ubuntu
vte package

  1. Bug #22052
  2. Comment #40

Comment 40 for bug 22052

Revision history for this message
In , Joey Hess (joeyh) wrote : exploit via escape sequences?

Well if this allows arbitrary data to be fed into the file and later
be displayed by who or last then that data could be made to contain
escape sequences, and either hide other lines that would normally be
displayed (so you don't know someone has logged into the machine), or
output other malicious escape sequences (key rebindings, whatever).

Haven't tried it but it's a thought.

--
see shy jo