VulnerabilityModified
CVE-2015-6806
The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.
MEDIUM 5.0EPSS 4.15%
Does this matter?
Lower severity and a low EPSS score (4.15%). Track it; it rarely justifies an emergency change on its own.
Description
The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 4.15% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- gnu/gnu screen
- Source
- cve@mitre.org
References
- http://git.savannah.gnu.org/cgit/screen.git/commit/?id=b7484c224738247b510ed0d268cd577076958f1b
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00001.html
- http://www.debian.org/security/2015/dsa-3352
- http://www.openwall.com/lists/oss-security/2015/09/01/1
- http://www.openwall.com/lists/oss-security/2015/09/03/11Exploit
- http://www.openwall.com/lists/oss-security/2015/09/03/4
- https://savannah.gnu.org/bugs/?45713Exploit, Vendor Advisory
- https://usn.ubuntu.com/3996-1/
- http://git.savannah.gnu.org/cgit/screen.git/commit/?id=b7484c224738247b510ed0d268cd577076958f1b
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00001.html
- http://www.debian.org/security/2015/dsa-3352
- http://www.openwall.com/lists/oss-security/2015/09/01/1
- http://www.openwall.com/lists/oss-security/2015/09/03/11Exploit
- http://www.openwall.com/lists/oss-security/2015/09/03/4
- https://savannah.gnu.org/bugs/?45713Exploit, Vendor Advisory
- https://usn.ubuntu.com/3996-1/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.