Security readout for executives and security teams
Plain-English summary
CVE-1999-0965 describes a legacy xterm race condition where a local user could abuse the logging option to modify arbitrary files. The provided sources do not name affected versions, a vendor advisory, CVSS, or a confirmed fix. Treat this mainly as a legacy Unix/Linux workstation and terminal-emulator exposure question.
Executive priority
Medium attention for organizations operating legacy shared Unix/Linux environments; lower urgency for environments without xterm or untrusted local users. Because severity and fixes are not detailed in the sources, validate exposure before treating it as an emergency.
Technical view
The issue is described as a race condition in xterm tied to its logging option, allowing local users to modify arbitrary files. Available source data does not define affected releases, prerequisites, privilege impact, or patch lineage. No KEV listing is provided, so active exploitation is not established by the bundle.
Likely exposure
Exposure is most plausible on older systems that include vulnerable xterm builds and allow untrusted local users to start xterm with logging enabled. The bundle does not identify modern affected packages or distributions.
Exploitation context
The sources support local-user abuse only. They do not show remote exploitation, public weaponization, active exploitation, or inclusion in CISA KEV. Impact depends on local permissions and how xterm logging interacts with target files.
Researcher notes
Evidence is sparse: CVE data gives the core race-condition description, X-Force is the only listed external reference, and affected products are marked n/a. Avoid expanding scope beyond xterm logging and local file modification without additional primary vendor evidence.
Mitigation direction
- Check current OS or distribution xterm advisories for affected versions and fixes.
- Update xterm through supported vendor package channels where applicable.
- Disable or avoid xterm logging on shared systems until vendor status is confirmed.
- Restrict local shell access to trusted users on legacy multi-user hosts.
Validation and detection
- Inventory systems where xterm is installed and available to local users.
- Confirm installed xterm versions against vendor or distribution security notes.
- Review whether xterm logging is enabled, exposed, or documented for users.
- Prioritize legacy shared Unix/Linux hosts over single-user modern desktops.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-1999-0965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0965CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.