Debian: DSA-380-1 Critical: XFree86 Buffer Overflow And DoS Exploit

Four vulnerabilities have been discovered in XFree86.

CAN-2003-0063 - xterm window title reporting escape sequence can deceive user

The xterm package provides a terminal escape sequence that reports
the window title by injecting it into the input buffer of the
terminal window, as if the user had typed it. An attacker can craft
an escape sequence that sets the title of a victim's xterm window to
an arbitrary string (such as a shell command) and then reports that
title. If the victim is at a shell prompt when this is done, the
injected command will appear on the command line, ready to be run.
Since it is not possible to embed a carriage return in the window
title, the attacker would have to convince the victim to press Enter
(or rely upon the victim's careless or confusion) for the shell or
other interactive process to interpret the window title as user
input. It is conceivable that the attacker could craft other escape
sequences that might convince the victim to accept...