oss-security - Re: screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aCb4I6AwLnGeruFC@kasco.suse.de>
Date: Fri, 16 May 2025 10:32:35 +0200
From: Matthias Gerstner <mgerstner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: screen: Multiple Security Issues in Screen
 (mostly affecting release 5.0.0 and setuid-root installations)

Hi,

On Thu, May 15, 2025 at 04:09:51PM +0100, Stuart Henderson wrote:
> On 2025/05/14 13:26, Matthias Gerstner wrote:
> > Indeed, this is the bugfix release announced by upstream here:
> > 
> > https://lists.gnu.org/archive/html/screen-users/2025-05/msg00005.html
> 
> There are two different versions of the tar.gz; at present, some of the
> gnu.org mirrors have one, some have another. The earlier one includes
> .o and other generated files, also there are differences to some source
> and headers around WINESC_WIN_CARET.
> 
> It would probably be helpful to make a 5.0.2 release to make it a little
> more clear.

these inconsistencies confirm the impressions we gained during the
coordinated disclosure. We believe that there are no well established
(release, development) processes existing in the GNU Screen upstream
project anymore.

I don't think this list is the right place bring forward these issues,
however. You can try on the screen-devel mailing list [1], where some
issues with the release tarball already seem to be discussed.

[1]: https://lists.gnu.org/archive/html/screen-devel

Cheers

Matthias

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.