Summary
It was discovered that GNU Screen was not properly checking user
identifiers before sending certain signals to target processes. If GNU
Screen was installed as setuid or setgid, a local attacker could possibly
use this issue to cause a denial of service on a target application.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | screen | 4.1.0~20120320gitdb59704-9ubuntu0.1~esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | screen | 4.3.1-2ubuntu0.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | screen | 4.6.2-1ubuntu1.1+esm1 |
Vulnerabilities 1
-
Medium 6.5CVE-2023-24626 Public exploit
socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and …
References
-
report
https://ubuntu.com/security/CVE-2023-24626