Vulnerability · Published Nov 6, 2020 · Assigned by canonical
CVE-2020-27347tmux stack buffer overflow in function input_csi_dispatch_sgr_colon
High 8.8
In plain English
A high-severity stack buffer overflow in tmux from tmux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | tmux | 3.1c-r0 | ALPINE-CVE-2020-27347 |
| Alpine:v3.21 | tmux | 3.1c-r0 | ALPINE-CVE-2020-27347 |
| Alpine:v3.22 | tmux | 3.1c-r0 | ALPINE-CVE-2020-27347 |
| Alpine:v3.23 | tmux | 3.1c-r0 | ALPINE-CVE-2020-27347 |
| Alpine:v3.24 | tmux | 3.1c-r0 | ALPINE-CVE-2020-27347 |
| Debian:12 | tmux | 3.1c-1 | DEBIAN-CVE-2020-27347 |
| Debian:13 | tmux | 3.1c-1 | DEBIAN-CVE-2020-27347 |
| Debian:14 | tmux | 3.1c-1 | DEBIAN-CVE-2020-27347 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701c x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2020/11/05/3 x_refsource_MISC
- GLSA-202011-10 vendor-advisory, x_refsource_GENTOO
- https://raw.githubusercontent.com/tmux/tmux/3.1c/CHANGES x_refsource_CONFIRM