CVE-2020-9366
screen: Out of bounds access when setting w_xtermosc after OSC 49
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (moyenne).
Description
A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | screen | 4.6.2-r1 |
| alpine 3.11 | screen | 4.7.0-r1 |
| alpine 3.12 | screen | 4.8.0-r0 |
| alpine 3.13 | screen | 4.8.0-r0 |
| alpine 3.14 | screen | 4.8.0-r0 |
| alpine 3.15 | screen | 4.8.0-r0 |
| alpine 3.16 | screen | 4.8.0-r0 |
| alpine 3.17 | screen | 4.8.0-r0 |
| alpine 3.18 | screen | 4.8.0-r0 |
| alpine 3.19 | screen | 4.8.0-r0 |
| alpine 3.20 | screen | 4.8.0-r0 |
| alpine 3.21 | screen | 4.8.0-r0 |
Afficher les 23 entrées de 23 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| alpine 3.10 | screen | 4.6.2-r1 |
| alpine 3.11 | screen | 4.7.0-r1 |
| alpine 3.12 | screen | 4.8.0-r0 |
| alpine 3.13 | screen | 4.8.0-r0 |
| alpine 3.14 | screen | 4.8.0-r0 |
| alpine 3.15 | screen | 4.8.0-r0 |
| alpine 3.16 | screen | 4.8.0-r0 |
| alpine 3.17 | screen | 4.8.0-r0 |
| alpine 3.18 | screen | 4.8.0-r0 |
| alpine 3.19 | screen | 4.8.0-r0 |
| alpine 3.20 | screen | 4.8.0-r0 |
| alpine 3.21 | screen | 4.8.0-r0 |
| alpine 3.22 | screen | 4.8.0-r0 |
| alpine 3.23 | screen | 4.8.0-r0 |
| alpine 3.24 | screen | 4.8.0-r0 |
| alpine 3.8 | screen | 4.6.2-r1 |
| alpine 3.9 | screen | 4.6.2-r1 |
| alpine edge | screen | 4.8.0-r0 |
| debian 11 | screen | 4.8.0-1 |
| debian 12 | screen | 4.8.0-1 |
| debian 13 | screen | 4.8.0-1 |
| debian 14 | screen | 4.8.0-1 |
| echo | screen | 4.8.0-1 |
Références
- http://www.openwall.com/lists/oss-security/2020/02/25/1
- https://access.redhat.com/security/cve/CVE-2020-9366
- https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-9366
- https://security.gentoo.org/glsa/202003-62
- https://www.cve.org/CVERecord?id=CVE-2020-9366
- https://www.openwall.com/lists/oss-security/2020/02/06/3