CVE-2017-5618

NameCVE-2017-5618
DescriptionGNU screen before 4.5.1 allows local users to modify arbitrary files and consequently gain root privileges by leveraging improper checking of logfile permissions.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh
Debian Bugs852484

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
screen (PTS)jessie (security), jessie4.2.1-3+deb8u1fixed
stretch4.5.0-6fixed
buster4.6.2-3fixed
bullseye, sid4.7.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
screensource(unstable)4.5.0-3852484
screensourcejessie(not affected)
screensourcestretch(not affected)
screensourcewheezy(not affected)

Notes

[stretch] - screen <not-affected> (Vulnerable code not present/never migrated to stretch)
[jessie] - screen <not-affected> (Vulnerable code not present)
[wheezy] - screen <not-affected> (Vulnerable code not present)
https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
https://savannah.gnu.org/bugs/?50142
Introduced in (screen-v4): http://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v4&id=5460f5d28c01a9a58e021eb1dffef2965e629d58
Introduced in (master): http://git.savannah.gnu.org/cgit/screen.git/commit/?id=c575c40c9bd7653470639da32e06faed0a9b2ec4
http://www.openwall.com/lists/oss-security/2017/01/24/10

Search for package or bug name: Reporting problems