GNU Screen vulnerabilities

9 CVEs affecting GNU Screen, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-24626, published 2023-04-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-26937, published 2021-02-09. Critical severity, CVSS 9.8. EPSS: 9.1% chance of exploitation in the next 30 days. encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8…
CVE-2003-0972, published 2003-12-15. High severity, CVSS 10.0. EPSS: 3.6% chance of exploitation in the next 30 days. Integer signedness error in ansi.c for GNU screen 4.0.1 and earlier, and 3.9.15 and earlier, allows local users to execute arbitrary code via a large number of ";" (semicolon) characters in escape…
CVE-2020-9366, published 2020-02-24. Critical severity, CVSS 9.8. EPSS: 2.7% chance of exploitation in the next 30 days. A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly…
CVE-2006-4573, published 2006-10-24. Low severity, CVSS 2.6. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in the "utf8 combining characters handling" (utf8_handle_comb function in encoding.c) in screen before 4.0.3 allows user-assisted attackers to cause a denial of…
CVE-2002-1602, published 2002-04-23. Medium severity, CVSS 4.6. EPSS: 1.3% chance of exploitation in the next 30 days. Buffer overflow in the Braille module for GNU screen 3.9.11, when HAVE_BRAILLE is defined, allows local users to execute arbitrary code.
CVE-2017-5618, published 2017-03-20. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. GNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
CVE-2007-3048, published 2007-06-05. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. GNU screen 4.0.3 allows local users to unlock the screen via a CTRL-C sequence at the password prompt. NOTE: multiple third parties report inability to reproduce this issue
CVE-2023-24626, published 2023-04-08. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. socket.c in GNU Screen through 4.9.0, when installed setuid or setgid (the default on platforms such as Arch Linux and FreeBSD), allows local users to send a privileged SIGHUP signal to any PID,…
CVE-2009-1214, published 2009-04-01. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. GNU screen 4.0.3 creates the /tmp/screen-exchange temporary file with world-readable permissions, which might allow local users to obtain sensitive session information.