XPost: linux.debian.maint.boot, linux.debian.devel.release
This is a multi-part MIME message sent by reportbug.
Package: release.debian.org
Severity: normal
X-Debbugs-Cc:
screen@packages.debian.org, Axel Beckert (Debian Developer) <
abe@debian.org>, Christian Hofstaedtler <
zeha@debian.org>,
debian-boot@lists.debian.org,
kibi@debian.org,
carnil@debian.org
Control: affects -1 + src:screen
User:
release.debian.org@packages.debian.org
Usertags: unblock
Hi Release team,
[Cc'ing as well debian-boot and Cyril, as screen produces a udeb and
needs an ack for d-i, additionally we are freezing udebs for the d-i preparation]
Please unblock package screen
screen as announced in [oss-security] is affected by several
vulnerabilities, furtunately by default in Debian screen is not
installed setuid. We think that having fixes for those (and later
maybe via point release in bookworm as well) might be sensible.
The concrete CVEs are CVE-2025-46802, CVE-2025-46804 and
CVE-2025-46805.
[oss-security]: <
https://www.openwall.com/lists/oss-security/2025/05/12/1>
One very important remark for the CVE-2025-46802 patches, from the
finding:
| Shortly before the publication of this report it was pointed out to us
| that this patch likely breaks some reattach use cases [12] in screen.
| We can confirm this problem, but at the same time found out that this
| specific use case was obviously already broken before, even in Screen
| 4.9.1 [13]. For this reason we decided not to move the publication
| date again or to adjust this patch in a hurry with uncertain results.
| The patch still fixes the security issue and upstream can now fix this
| regression, that already seems to have existed earlier, in the open.
Additionally there is an Upload from Chris Hofstaedtler
<
zeha@debian.org> which has not yet migrated to testing (but would if
the additional time would pass without RC report).
Talking with Chris he would be fine to have additional time to wait
for his change to go in and so the we can either wait for the second
upload and first make 4.9.1-2 go to testing or override the upload.
Currently with the udeb freeze it cannot move anyway.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
Talking to Axel, I might not do the actual upload but the upload might
come from the maintainer himself (very welcome, thanks Axel!) so there
would be the making it a maintainer upload.
unblock screen/4.9.1-2.1
Let us know if you need anything else for clarification.
Regards,
Salvatore
diff -Nru screen-4.9.1/debian/changelog screen-4.9.1/debian/changelog
--- screen-4.9.1/debian/changelog 2025-05-10 22:28:23.000000000 +0200
+++ screen-4.9.1/debian/changelog 2025-05-16 17:46:51.000000000 +0200
@@ -1,3 +1,13 @@
+screen (4.9.1-2.1) unstable; urgency=medium
+
+ * Non-maintainer upload (with maintainers approval)
+ * attacher.c - prevent temporary 0666 mode on PTYs (CVE-2025-46802)
+ (Closes: #1105191)
+ * avoid file existence test information leaks (CVE-2025-46804)
+ * socket.c - don't send signals with root privileges (CVE-2025-46805)
+
+ -- Salvatore Bonaccorso <
carnil@debian.org> Fri, 16 May 2025 17:46:51 +0200 +
screen (4.9.1-2) unstable; urgency=medium
* Team upload (debian/ namespace).
diff -Nru screen-4.9.1/debian/patches/fix-CVE-2025-46802-attacher.c-prevent-temporary-0666.patch screen-4.9.1/debian/patches/fix-CVE-2025-46802-attacher.c-prevent-temporary-0666.patch
--- screen-4.9.1/debian/patches/fix-CVE-2025-46802-attacher.c-prevent-temporary-0666.patch 1970-01-01 01:00:00.000000000 +0100
+++ screen-4.9.1/debian/patches/fix-C