Commit Graph

6 Commits

Author SHA1 Message Date
Divya Chellam
50475a377a screen: fix CVE-2025-46804
A minor information leak when running Screen with setuid-root
privileges allosw unprivileged users to deduce information
about a path that would otherwise not be available.

Affected are older Screen versions, as well as version 5.0.0.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-46804

Upstream-patch:
https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=e0eef5aac453fa98a2664416a56c50ad1d00cb30

(From OE-Core rev: fa14b05383a322f5fe751c81e8c6f1a8a1df8c9e)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-13 08:42:35 -07:00
Divya Chellam
145b1ddb2b screen: fix CVE-2025-46802
For a short time they PTY is set to mode 666, allowing any user on the
system to connect to the screen session.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-46802

Upstream-patch:
https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=049b26b22e197ba3be9c46e5c193032e01a4724a

(From OE-Core rev: b4074e06ff0531481dbb3788a5c1bf9e013b6239)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-13 08:42:35 -07:00
Hitendra Prajapati
14d260ab25 screen: Fix CVE-2025-46805
Upstream-Status: Backport from https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=161f85b98b7e1d5e4893aeed20f4cdb5e3dfaaa4

(From OE-Core rev: b25b0f785e0b7650e31a45a92be196be6b76ea78)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-06-04 09:06:31 -07:00
Hitendra Prajapati
d19f7ddf5a screen: CVE-2023-24626 allows sending SIGHUP to arbitrary PIDs
Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/screen.git/commit/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7

(From OE-Core rev: cf6348b5778c9409fc330808effc69e9939e6857)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-04-26 04:03:21 -10:00
Richard Purdie
b0130fcf91 meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers
An automated conversion using scripts/contrib/convert-spdx-licenses.py to
convert to use the standard SPDX license identifiers. Two recipes in meta-selftest
were not converted as they're that way specifically for testing. A change in
linux-firmware was also skipped and may need a more manual tweak.

(From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-20 16:45:25 +00:00
wangmy
3fb9966b4f screen: upgrade 4.8.0 -> 4.9.0
CVE-2021-26937.patch
removed since it is included in 4.9.0

Changelog:
=========
* Hardstatus option for used encoding (escape string '%e')
* OpenBSD uses native openpty() from its utils.h
* Fixes:
  - fix combining char handling that could lead to a segfault
  - CVE-2021-26937: possible denial of service via a crafted UTF-8 character sequence (bug #60030)
  - make screen exit code be 0 when checking --help
  - session names limit is 80 symbols (bug #61534)
  - option -X ignores specified user in multiuser env (bug #37437)
  - a lot of reformations/fixes/cleanups (man page and source code)

(From OE-Core rev: 8247097d2313ceb73bab1621d61b8aa3fb59095e)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-10 10:32:08 +00:00