https://seclists.org/oss-sec/2025/q2/117: scen: Multiple Security Issues in Scen (mostly affecting lease 5.0.0 and setuid-root installations)

Q: Which deployments face the highest risk?

GNU Screen 5.0.0 installations that are shipped setuid-root are the primary concern. The report specifically identifies Arch Linux and NetBSD as distributions with this exposure.

Q: What access would an attacker need to exploit the most severe issue?

The most severe issue is described as a local root exploit. An attacker would therefore need local access to the affected system.

Q: Are older GNU Screen releases also affected?

Some additional, less severe issues partly affect older Screen versions, including versions still used by the majority of distributions. The provided information does not identify the exact older versions affected by each issue.

Q: Are fixes available for the affected release tarballs?

Two patch sets were provided: one applying to the screen-4.9.1 release tarball and one applying to the screen-5.0.0 release tarball.

Published May 12, 2025

Updated

Affected Software

1 affected component

SUSE Screen>=4.9.1<=4.9.1

Frequently Asked Questions

Which deployments face the highest risk?

GNU Screen 5.0.0 installations that are shipped setuid-root are the primary concern. The report specifically identifies Arch Linux and NetBSD as distributions with this exposure.

What access would an attacker need to exploit the most severe issue?

The most severe issue is described as a local root exploit. An attacker would therefore need local access to the affected system.

Are older GNU Screen releases also affected?

Some additional, less severe issues partly affect older Screen versions, including versions still used by the majority of distributions. The provided information does not identify the exact older versions affected by each issue.

Are fixes available for the affected release tarballs?