[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20200225191538.54fc0d2e@milkyway.galaxy>
Date: Tue, 25 Feb 2020 19:15:38 +0100
From: Amadeusz Sławiński <amade@...blr.net>
To: Salvatore Bonaccorso <carnil@...ian.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: GNU screen "out of bounds access when setting
w_xtermosc after OSC 49"
On Tue, 25 Feb 2020 14:05:33 +0100
Salvatore Bonaccorso <carnil@...ian.org> wrote:
> Hi
>
> On Thu, Feb 06, 2020 at 03:04:18PM +0100, Solar Designer wrote:
> > Hi,
> >
> > GNU screen 4.8.0 was released yesterday with a documented security fix
> > in it:
> >
> > https://lists.gnu.org/archive/html/screen-devel/2020-02/msg00007.html
> >
> > ---
> > From: Amadeusz Slawinski
> > Subject: [screen-devel] GNU Screen v.4.8.0
> > Date: Wed, 5 Feb 2020 21:45:35 +0100
> >
> > Hello everyone,
> >
> > I'm announcing availability of GNU Screen v.4.8.0
> >
> > Screen is a full-screen window manager that multiplexes a physical
> > terminal between several processes, typically interactive shells.
> >
> > This release
> > * Improves startup time by only polling for already open files to
> > close
> > * Fixes:
> > - Fix for segfault if termcap doesn't have Km entry
> > - Make screen exit code be 0 when checking --version
> > - Fix potential memory corruption when using OSC 49
> >
> > As last fix, fixes potential memory overwrite of quite big size (~768
> > bytes), and even though I'm not sure about potential exploitability of
> > that issue, I highly recommend everyone to upgrade as soon as possible.
> > This issue is present at least since v.4.2.0 (haven't checked earlier).
> > Thanks to pippin who brought this to my attention.
>
> Regarding the affected versions,
> https://bugzilla.redhat.com/show_bug.cgi?id=1801405#c6 points out that
> the issue is caused by the upsteram commit
> https://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v4&id=c5db181b6e017cfccb8d7842ce140e59294d9f62
> which would be only in v4.7.0.
>
> Is this correct?
>
Right, that seems correct.
There is also another fix that should've been made:
https://git.savannah.gnu.org/cgit/screen.git/commit/?id=b14e76eb5d6be889d58e37e420384e59a74eddd6
Will try to release 4.8.1 with it soon.
Amadeusz
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
