[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <yxzsn67mzkjf2bxwkjah6u5q54yg2mqj7tlysm7mjeo4xytwhr@24dslwvnetyr>
Date: Thu, 15 May 2025 16:09:51 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: screen: Multiple Security Issues in Screen
(mostly affecting release 5.0.0 and setuid-root installations)
On 2025/05/14 13:26, Matthias Gerstner wrote:
> Hi,
>
> On Tue, May 13, 2025 at 03:48:31PM -0700, Mark Esler wrote:
> > Cheers for the report Matthias and SUSE Security!
>
> thanks!
>
> > Could you please comment on the affectedness of upstream screen 5.0.1?
> >
> > https://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v5&id=464c8d8f945f53f8cbb854517279349e09d74756
> >
> > This version was released ~an hour before your initial oss post. It appears
> > that upstream landed the patches, which may be worth mentioning in your
> > timeline.
>
> Indeed, this is the bugfix release announced by upstream here:
>
> https://lists.gnu.org/archive/html/screen-users/2025-05/msg00005.html
There are two different versions of the tar.gz; at present, some of the
gnu.org mirrors have one, some have another. The earlier one includes
.o and other generated files, also there are differences to some source
and headers around WINESC_WIN_CARET.
It would probably be helpful to make a 5.0.2 release to make it a little
more clear.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
