CVE-2020-27347: tmux_project tmux Stack-based Buffer Overflow
CVSS: 8.8v3.1HighModified
AliasesALPINE-CVE-2020-27347UBUNTU-CVE-2020-27347USN-4618-1DEBIAN-CVE-2020-27347
Published 06-11-2020Last modified 17-09-2024
Vulnerability summary
CVE-2020-27347 is a high (CVSS 8.8) Stack-based Buffer Overflow vulnerability in tmux_project tmux. EPSS estimates a 0.69% chance of exploitation in the next 30 days, higher than 52% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.8/10
010
High · v3.1 (CVE.org)EPSS score
0.69%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 06-11-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.
CVSS metrics
6 scores · 5 sources · 2 versionsHigh 8.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSources5 sources · 7.8–8.8
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
Medium 4.6Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.69%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
0.00 pp
From 0.69% on 19-09-2026
19-09-202619-10-2026
EPSS score0.69%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Ubuntu2 products
- tmux< 3.0a-2ubuntu0.2
- tmux≥ 3.1b, < 3.1b-1ubuntu0.1 | ≥ 3.0a, < 3.0a-2ubuntu0.2
Alpine1 product
- tmux≥ 2.9, < 2.9a-r2 | ≥ 2.9, < 3.0a-r2 | ≥ 2.9, < 3.1c-r0
Debian1 product
- tmux< 3.1c-1
Tmux1 product
- tmux≥ unspecified, < 3.1c
Tmux_project1 product
- tmux≥ 2.9, ≤ 3.1b
5 vendors · 6 products
References
9 links- github.com/tmux/tmux/commit/a868bacb46e3c900530bed47a1c6f85b0fbe701cX Refsource MISCPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2020/11/05/3X Refsource MISCExploitMailing ListThird Party Advisory
- raw.githubusercontent.com/tmux/tmux/3.1c/CHANGESX Refsource CONFIRMREPORTRelease NotesThird Party Advisory
