Kitty Terminal Security PSA

If you are using the kitty terminal @kittyterminal, go get your security update!

"The handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles().

No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window."

https://github.com/kovidgoyal/kitty/security/advisories/GHSA-qfgm-2c64-6x3x

#cybersecurity #infosec #kittyterminal

I installed two terminals that I see a lot of on the web: Kitty and Ghostty, today I wrote a small little config file to get started with Kitty. As one of my favorite colors is orange and fonts Lucida Console (as it's readable) I began with assigning those basic things to my Kitty config file.

I need to get comfortable with config files again, as eventually it will be an essential part of my life. I do plan on going to a Systemd free NixOS, FreeBSD, or a few other options that have cropped up.

As my laundry is nearly done (comforter is in the dryer for a long dry cycle) this is a perfect little diversion to delay my boredom.

The website for further customization is:

https://sw.kovidgoyal.net/kitty/#configuring-kitty

#KittyTerminal #config #Linux

kitty 0.46.2 released - changelog

https://midwest.social/post/44931202

kitty 0.46.1 released - changelog

https://midwest.social/post/44743378

kitty 0.46.0 released - changelog

https://midwest.social/post/44533129

kitty (1) kann übrigens Bilder im Terminal darstellen. Braucht vermutlich niemand, ist aber leider geil!

#Linux #kittyterminal