Alpine: multiple screen packages: security update to 5.0.1-r0

high Tenable Cloud Security Plugin ID 425967

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Screen 5.0.0 when it runs with setuid-root privileges does not drop privileges while operating on a user
supplied path. This allows unprivileged users to create files in arbitrary locations with `root`
ownership, the invoking user's (real) group ownership and file mode 0644. All data written to the Screen
PTY will be logged into this file, allowing to escalate to root privileges (CVE-2025-23395)

- For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen
session. (CVE-2025-46802)

- The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby
allowing anyone to write to any Screen PTYs in the system. (CVE-2025-46803)

- A minor information leak when running Screen with setuid-root privileges allows unprivileged users to
deduce information about a path that would otherwise not be available. Affected are older Screen versions,
as well as version 5.0.0. (CVE-2025-46804)

- Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP,
SIGCONT to privileged processes when installed setuid-root. (CVE-2025-46805)

Plugin Details

Severity: High

ID: 425967

Version: Revision 1.10

Type: Local

Family: Alpine Linux Local Security Checks

Published: 5/14/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.59

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-23395

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.3

Threat Score: 4.4

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/21/2025

Reference Information

CVE: CVE-2025-23395, CVE-2025-46802, CVE-2025-46803, CVE-2025-46804, CVE-2025-46805

Detections

Analytics