CVE-2020-27347

Published: 4 November 2020

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

Priority

Medium

CVSS 3 base score: 8.5

Status

Notes

Affects tmux versions >= 2.9

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27347
• https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES
• https://ubuntu.com/security/notices/USN-4618-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1893339