CVE-2025-46804

Name
CVE-2025-46804
Description
A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0.
NVD Severity
low
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
meissner@suse.de https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46804
meissner@suse.de https://www.openwall.com/lists/oss-security/2025/05/12/1

Match rules

CPE URI Source package Min version Max version
shopxo >= 5.0 <= 5.0.0
shopxo >= ? <= 4.9.1

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
screen edge-main 5.0.1-r0 Celeste <cielesti@protonmail.com> fixed
screen 3.23-main 5.0.1-r0 Celeste <cielesti@protonmail.com> fixed
screen 3.22-main 5.0.1-r0 Celeste <cielesti@protonmail.com> fixed
screen 3.21-main 5.0.1-r0 Celeste <cielesti@protonmail.com> fixed
screen 3.20-main 4.9.1_git20250512-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
screen 3.19-main 4.9.1_git20250512-r0 Natanael Copa <ncopa@alpinelinux.org> fixed
screen 3.18-main 4.9.1_git20250512-r0 Natanael Copa <ncopa@alpinelinux.org> fixed