rxvt-unicode 9.25 and 9.26 are vulnerable to remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. The "background" extension is automatically loaded if certain X resources are set such as 'transparent' (see the full list at the top of src/perl/background). So it is possible to be using this extension without realizing it. This is accidentally fixed on version 9.30, and 9.29, it appears to not be exploitable, but only due to another bug (not a security bug). The actual bug which makes this not vulnerable on 9.30 is simply a wrong number in "on_osc_seq".
Created rxvt-unicode tracking bugs for this issue: Affects: epel-all [bug 2151598] Affects: fedora-all [bug 2151599]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.
> Affects: fedora-all [bug 2151599] Current fedora versions: fc38: rxvt-unicode-9.30-4.fc37 fc37: rxvt-unicode-9.30-4.fc37 fc36: rxvt-unicode-9.30-2.fc36 > This is accidentally fixed on version 9.30, and 9.29, it appears to not be exploitable, but only due to another bug (not a security bug). Given this, I really don't see what action you expect me to take with that bug.