CVE catalog

CVE-2020-9366

screen: CVE-2020-9366

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
2.71% · Oct 27, 2026

A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianscreensid5.0.2-1fixed
Debianscreenforky5.0.2-1fixed
Debianscreentrixie4.9.1-3fixed
Debianscreenbookworm4.9.0-4fixed
Alpinescreen3.104.6.2-r1fixed
Alpinescreen3.114.7.0-r1fixed
Alpinescreen3.124.8.0-r0fixed
Alpinescreen3.134.8.0-r0fixed
Alpinescreen3.144.8.0-r0fixed
Alpinescreen3.154.8.0-r0fixed
Alpinescreen3.164.8.0-r0fixed
Alpinescreen3.174.8.0-r0fixed
Alpinescreen3.184.8.0-r0fixed
Alpinescreen3.194.8.0-r0fixed
Alpinescreen3.204.8.0-r0fixed
Alpinescreen3.214.8.0-r0fixed
Alpinescreen3.224.8.0-r0fixed
Alpinescreen3.234.8.0-r0fixed
Alpinescreen3.244.8.0-r0fixed
Alpinescreen3.84.6.2-r1fixed
Alpinescreen3.94.6.2-r1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianscreensourcesid4.8.0-1not yet assignedNot reported[950896]
Debianscreensourceforky4.8.0-1not yet assignedNot reported[950896]
Debianscreensourcetrixie4.8.0-1not yet assignedNot reported[950896]
Debianscreensourcebookworm4.8.0-1not yet assignedNot reported[950896]
Alpinescreenapk3.104.6.2-r1Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.114.7.0-r1Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.124.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.134.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.144.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.154.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.164.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.174.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.184.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.194.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.204.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.214.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.224.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.234.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.244.8.0-r0Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.84.6.2-r1Not reportedALPINE-CVE-2020-9366Not reported
Alpinescreenapk3.94.6.2-r1Not reportedALPINE-CVE-2020-9366Not reported

[Debian bug #950896]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [screen]Fixed
    Details (2)

    • 4.9.0-4 · amd64 · bookworm

      Fixed · Fixed: 4.8.0-1

      dsa · screen · debian · bookworm; dsa · screen · debian · 12

    • 4.9.0-4 · arm64 · bookworm

      Fixed · Fixed: 4.8.0-1

      dsa · screen · debian · bookworm; dsa · screen · debian · 12

[Debian 13 (Trixie)]

  • [screen]Fixed
    Details (2)

    • 4.9.1-3 · amd64 · trixie

      Fixed · Fixed: 4.8.0-1

      dsa · screen · debian · 13

    • 4.9.1-3 · arm64 · trixie

      Fixed · Fixed: 4.8.0-1

      dsa · screen · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]