Information Leak Vulnerability in Screen Package
Summary
ALPINE-CVE-2025-46804: A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that would otherwise not be available. Affects screen versions < 4.9.1_git20250512-r0. Fixed in 4.9.1_git20250512-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Screen package is a terminal multiplexer that allows users to manage multiple terminal sessions from a single window. It is widely used in Unix-like operating systems for its ability to detach and reattach sessions, making it a valuable tool for remote work and server management. However, certain versions of Screen have been found to have a vulnerability that can lead to information leaks when running with setuid-root privileges.
Vulnerability Detail
A minor information leak exists in older versions of the Screen package, as well as version 5.0.0. This vulnerability allows unprivileged users to deduce information about a path that would otherwise be restricted. The issue arises from the way Screen handles certain operations when elevated privileges are granted, potentially exposing sensitive information to unauthorized users.
How To Fix
Minimum fixed version
4.9.1_git20250512-r0
This is the first release that contains the fix.
sudo apk add --upgrade screenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider running Screen without setuid-root privileges to mitigate the risk of information leakage.
Conclusion
The Screen package has a vulnerability that can lead to information leaks when run with elevated privileges. Users are advised to update to the latest patched versions to secure their systems. For those unable to update immediately, running Screen without setuid-root privileges is a viable workaround.
See every vulnerability recorded for screen →
FAQ
The vulnerability allows unprivileged users to deduce information about restricted paths when Screen is run with elevated privileges.
Affected versions include older versions and version 5.0.0. Specific patched versions are available for Alpine Linux users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Update the Screen package to the patched version using the command 'apk add screen@<fixed_version>'.
Yes, you can run Screen without setuid-root privileges to reduce the risk of information leakage.
References
Related vulnerabilities
Recent vulnerabilities recorded for screen.
