Information Leak Vulnerability in Screen Package
Summary
CVE-2025-46804: A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affects screen versions < 4.9.1_git20250512-r0. Fixed in 4.9.1_git20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Screen package is a terminal multiplexer that allows users to manage multiple terminal sessions from a single window. It is widely used in Unix-like operating systems for its ability to detach and reattach sessions, making it a valuable tool for system administrators and developers. However, older versions of Screen, particularly those with setuid-root privileges, are vulnerable to an information leak that can expose sensitive path information to unprivileged users.
Vulnerability Detail
CVE-2025-46804 is a minor information leak vulnerability that occurs when running the Screen package with setuid-root privileges. This flaw allows unprivileged users to deduce information about a path that should otherwise remain confidential. The vulnerability affects older versions of Screen, including version 5.0.0, and poses a risk of unauthorized information disclosure, potentially leading to further exploitation.
How To Fix
Minimum fixed version
4.9.1_git20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade screenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider running Screen without setuid-root privileges to mitigate the risk of information leakage until the package can be updated.
Conclusion
CVE-2025-46804 is a significant vulnerability in the Screen package that can lead to information leaks when running with elevated privileges. It is crucial for users to update their installations to the latest patched versions to safeguard against potential exploitation. Utilizing tools like Vulert can help monitor and manage open-source vulnerabilities effectively.
See every vulnerability recorded for screen →
FAQ
CVE-2025-46804 is a vulnerability in the Screen package that allows unprivileged users to leak sensitive path information when the package is run with setuid-root privileges.
Older versions of Screen, including version 5.0.0 and earlier, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
The vulnerability can lead to unauthorized information disclosure, which may allow attackers to gain insights into the system's file structure and potentially exploit further vulnerabilities.
Yes, patches are available for the affected versions of Screen. Users should update to the specified patched versions to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for screen.
