[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200225130532.GA4071@lorien.valinor.li>
Date: Tue, 25 Feb 2020 14:05:33 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Amadeusz Slawinski <amade@...blr.net>
Subject: Re: GNU screen "out of bounds access when setting
w_xtermosc after OSC 49"
Hi
On Thu, Feb 06, 2020 at 03:04:18PM +0100, Solar Designer wrote:
> Hi,
>
> GNU screen 4.8.0 was released yesterday with a documented security fix
> in it:
>
> https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html
>
> ---
> From: Amadeusz Slawinski
> Subject: [screen-devel] GNU Screen v.4.8.0
> Date: Wed, 5 Feb 2020 21:45:35 +0100
>
> Hello everyone,
>
> I'm announcing availability of GNU Screen v.4.8.0
>
> Screen is a full-screen window manager that multiplexes a physical
> terminal between several processes, typically interactive shells.
>
> This release
> * Improves startup time by only polling for already open files to
> close
> * Fixes:
> - Fix for segfault if termcap doesn't have Km entry
> - Make screen exit code be 0 when checking --version
> - Fix potential memory corruption when using OSC 49
>
> As last fix, fixes potential memory overwrite of quite big size (~768
> bytes), and even though I'm not sure about potential exploitability of
> that issue, I highly recommend everyone to upgrade as soon as possible.
> This issue is present at least since v.4.2.0 (haven't checked earlier).
> Thanks to pippin who brought this to my attention.
Regarding the affected versions,
https://bugzilla.redhat.com/show_bug.cgi?id=1801405#c6 points out that
the issue is caused by the upsteram commit
https://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v4&id=c5db181b6e017cfccb8d7842ce140e59294d9f62
which would be only in v4.7.0.
Is this correct?
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
