CVE-2020-9366 A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have...
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/screen(Debian:12) | < 4.8.0-1 | 4.8.0-1 |
| debian/screen(Debian:13) | < 4.8.0-1 | 4.8.0-1 |
| debian/screen(Debian:14) | < 4.8.0-1 | 4.8.0-1 |
| GNU screen | < 4.8.0 | 4.8.0 |
| alpine/screen(Alpine:v3.10) | < 4.6.2-r1 | 4.6.2-r1 |
| alpine/screen(Alpine:v3.11) | < 4.7.0-r1 | 4.7.0-r1 |
| alpine/screen(Alpine:v3.12) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.13) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.14) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.15) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.16) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.17) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.18) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.19) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.20) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.21) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.22) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.23) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.24) | < 4.8.0-r0 | 4.8.0-r0 |
| alpine/screen(Alpine:v3.8) | < 4.6.2-r1 | 4.6.2-r1 |
| alpine/screen(Alpine:v3.9) | < 4.6.2-r1 | 4.6.2-r1 |
References
- Debian Security Tracker CVE-2020-9366 vendor-advisory
- [oss-security] 20200225 Re: Re: GNU screen "out of bounds access when setting w_xtermosc after OSC 49" mailing-list third-party-advisory
- lists.gnu.org mailing-list patch release-notes vendor-advisory
- GLSA-202003-62 third-party-advisory vendor-advisory
- www.openwall.com mailing-list patch release-notes
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking