CVE-2021-27135

xterm before Patch #366 allows remote attackers to execute arbitrary code or cause a denial of service (segmentation fault) via a crafted UTF-8 combining character sequence.

• http://seclists.org/fulldisclosure/2021/May/52Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/02/10/7Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-27135Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1927559Issue Tracking
• https://bugzilla.suse.com/show_bug.cgi?id=1182091Issue Tracking
• https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075cPatch, Third Party Advisory
• https://invisible-island.net/xterm/xterm.log.htmlRelease Notes, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00019.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/
• https://news.ycombinator.com/item?id=26524650Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202208-22Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/02/09/7Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/02/09/9Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/May/52Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/02/10/7Mailing List, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2021-27135Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1927559Issue Tracking
• https://bugzilla.suse.com/show_bug.cgi?id=1182091Issue Tracking
• https://github.com/ThomasDickey/xterm-snapshots/commit/82ba55b8f994ab30ff561a347b82ea340ba7075cPatch, Third Party Advisory
• https://invisible-island.net/xterm/xterm.log.htmlRelease Notes, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/02/msg00019.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35LK2ZXEIJUOGOA7FV2TJL3L6LFJ4X5S/
• https://news.ycombinator.com/item?id=26524650Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202208-22Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/02/09/7Mailing List, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2021/02/09/9Mailing List, Third Party Advisory

Published

Feb 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-27117An issue was discovered in file profile.go in function GetCP…7.8
• CVE-2021-27124SQL injection in the expertise parameter in search_result.ph…6.5
• CVE-2021-27129CASAP Automated Enrollment System version 1.0 contains a cro…5.4
• CVE-2021-27130Online Reviewer System 1.0 contains a SQL injection vulnerab…9.8
• CVE-2021-27131Moodle 3.10.1 is vulnerable to persistent/stored cross-site …5.4
• CVE-2021-27132SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF inject…9.8
• CVE-2021-27137An issue was discovered in router/upnp/src/ssdp.c in DD-WRT …8.1
• CVE-2021-27138The boot loader in Das U-Boot before 2021.04-rc2 mishandles …7.8
• CVE-2021-27139An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27140An issue was discovered on FiberHome HG6245D devices through…7.5
• CVE-2021-27141An issue was discovered on FiberHome HG6245D devices through…9.8
• CVE-2021-27142An issue was discovered on FiberHome HG6245D devices through…7.5