Out-of-bounds write in tmux - CVE-2020-27347

Vulnerability identifier: #VU48517

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-27347

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to execute arbitrary code.

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

tmux
Gentoo Linux
openEuler
Ubuntu
tmux (Alpine package)
tmux
tmux-help
tmux-debugsource
tmux-debuginfo
tmux (Ubuntu package)

Install update from vendor's website.

tmux - update to 3.1c
tmux - update to 2.9a-2
tmux-help - update to 2.9a-2
tmux-debugsource - update to 2.9a-2
tmux-debuginfo - update to 2.9a-2
tmux (Ubuntu package) - addressed in versions 3.0a-2ubuntu0.2, 3.1b-1ubuntu0.1

• https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c
• https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES
• https://security.gentoo.org/glsa/202011-10
• https://www.openwall.com/lists/oss-security/2020/11/05/3

• Out-of-bounds write in tmux
• Out-of-bounds write in tmux (Alpine package)
• Gentoo update for tmux
• openEuler 20.03 LTS update for tmux
• Ubuntu update for tmux