[Buildroot] [PATCH] package/screen: security bump to version 5.0.1

[Buildroot] [PATCH] package/screen: security bump to version 5.0.1

[Peter Korsgaard]

Fixes the following security issues:

CVE-2025-46805: do NOT send signals with root privileges
CVE-2025-46804: avoid file existence test information leaks
CVE-2025-46803: apply safe PTY default mode of 0620
CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
CVE-2025-23395: reintroduce lf_secreopen() for logfile

https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html

For more details, see:
https://security.opensuse.org/2025/05/12/screen-security-issues.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/screen/screen.hash | 4 ++--
 package/screen/screen.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/screen/screen.hash b/package/screen/screen.hash
index 208a9cb36d..61bacd88ff 100644
--- a/package/screen/screen.hash
+++ b/package/screen/screen.hash
@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
-# https://ftp.gnu.org/gnu/screen/screen-5.0.0.tar.gz.sig
-sha256  f04a39d00a0e5c7c86a55338808903082ad5df4d73df1a2fd3425976aed94971  screen-5.0.0.tar.gz
+# https://ftp.gnu.org/gnu/screen/screen-5.0.1.tar.gz.sig
+sha256  2dae36f4db379ffcd14b691596ba6ec18ac3a9e22bc47ac239789ab58409869d  screen-5.0.1.tar.gz
 # Locally calculated
 sha256  e79e9c8a0c85d735ff98185918ec94ed7d175efc377012787aebcf3b80f0d90b  COPYING
diff --git a/package/screen/screen.mk b/package/screen/screen.mk
index 9a64780a9a..74453faff8 100644
--- a/package/screen/screen.mk
+++ b/package/screen/screen.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SCREEN_VERSION = 5.0.0
+SCREEN_VERSION = 5.0.1
 SCREEN_SITE = $(BR2_GNU_MIRROR)/screen
 SCREEN_LICENSE = GPL-3.0+
 SCREEN_LICENSE_FILES = COPYING
-- 
2.39.5

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/screen: security bump to version 5.0.1

[Julien Olivain]

On 16/05/2025 12:57, Peter Korsgaard wrote:
> Fixes the following security issues:
> 
> CVE-2025-46805: do NOT send signals with root privileges
> CVE-2025-46804: avoid file existence test information leaks
> CVE-2025-46803: apply safe PTY default mode of 0620
> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> CVE-2025-23395: reintroduce lf_secreopen() for logfile
> 
> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
> 
> For more details, see:
> https://security.opensuse.org/2025/05/12/screen-security-issues.html
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/screen: security bump to version 5.0.1

[Arnout Vandecappelle via buildroot]

On 16/05/2025 12:57, Peter Korsgaard wrote:
> Fixes the following security issues:
> 
> CVE-2025-46805: do NOT send signals with root privileges
> CVE-2025-46804: avoid file existence test information leaks
> CVE-2025-46803: apply safe PTY default mode of 0620
> CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
> CVE-2025-23395: reintroduce lf_secreopen() for logfile
> 
> https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html
> 
> For more details, see:
> https://security.opensuse.org/2025/05/12/screen-security-issues.html
> 
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

  Applied to 2025.02.x, thanks.

  Regards,
  Arnout

> ---
>   package/screen/screen.hash | 4 ++--
>   package/screen/screen.mk   | 2 +-
>   2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/package/screen/screen.hash b/package/screen/screen.hash
> index 208a9cb36d..61bacd88ff 100644
> --- a/package/screen/screen.hash
> +++ b/package/screen/screen.hash
> @@ -1,5 +1,5 @@
>   # Locally calculated after checking pgp signature
> -# https://ftp.gnu.org/gnu/screen/screen-5.0.0.tar.gz.sig
> -sha256  f04a39d00a0e5c7c86a55338808903082ad5df4d73df1a2fd3425976aed94971  screen-5.0.0.tar.gz
> +# https://ftp.gnu.org/gnu/screen/screen-5.0.1.tar.gz.sig
> +sha256  2dae36f4db379ffcd14b691596ba6ec18ac3a9e22bc47ac239789ab58409869d  screen-5.0.1.tar.gz
>   # Locally calculated
>   sha256  e79e9c8a0c85d735ff98185918ec94ed7d175efc377012787aebcf3b80f0d90b  COPYING
> diff --git a/package/screen/screen.mk b/package/screen/screen.mk
> index 9a64780a9a..74453faff8 100644
> --- a/package/screen/screen.mk
> +++ b/package/screen/screen.mk
> @@ -4,7 +4,7 @@
>   #
>   ################################################################################
>   
> -SCREEN_VERSION = 5.0.0
> +SCREEN_VERSION = 5.0.1
>   SCREEN_SITE = $(BR2_GNU_MIRROR)/screen
>   SCREEN_LICENSE = GPL-3.0+
>   SCREEN_LICENSE_FILES = COPYING

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot