CVE-2003-0972 Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape seq...
HighCVSS 10.0
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape sequences, which leads to a buffer overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU screen | = 3.9.4 | No fix listed |
| GNU screen | = 3.9.8 | No fix listed |
| GNU screen | = 3.9.9 | No fix listed |
| GNU screen | = 3.9.10 | No fix listed |
| GNU screen | = 3.9.11 | No fix listed |
| GNU screen | = 3.9.13 | No fix listed |
| GNU screen | = 3.9.15 | No fix listed |
| GNU screen | = 4.0.1 | No fix listed |
| debian/screen(Debian:12) | < 4.0.2-0.1 | 4.0.2-0.1 |
| debian/screen(Debian:13) | < 4.0.2-0.1 | 4.0.2-0.1 |
| debian/screen(Debian:14) | < 4.0.2-0.1 | 4.0.2-0.1 |
References
- CLA-2004:809 vendor-advisory
- groups.yahoo.com
- 20031127 GNU screen buffer overflow mailing-list
- 10539 third-party-advisory
- DSA-408 patch vendor-advisory
- MDKSA-2003:113 vendor-advisory
- Debian Security Tracker CVE-2003-0972 vendor-advisory