Every CVE Search/ Get API key

CVE-2015-6806

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion...

5.0 MediumFix available

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Exploit likelihood

4.15%Up 2.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
CVE-2015-6806
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
CVE-2015-6806
Updated
2026-11-02
EUVDEUVD-2015-6743 No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
EUVD-2015-6743
Updated
2026-11-03
GitHub AdvisoriesGHSA-3cxx-6jhw-pqvg No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion...

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
GHSA-3cxx-6jhw-pqvg
Weakness
CWE-119
Updated
2026-11-02
OSV No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
CVE-2015-6806
Updated
2026-11-02
OSVDEBIAN-CVE-2015-6806 No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
DEBIAN-CVE-2015-6806
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2015-0354 No score

Updated screen packages fix CVE-2015-6806

Updated screen package fixes security vulnerability:

A vulnerability was found in screen causing a stack overflow which results in crashing the screen server process, resulting in denial of service (CVE-2015-6806).

Record
MGASA-2015-0354
Updated
2026-11-02
OSVSUSE-SU-2019:1354-1 No score

Security update for screen

This update for screen fixes the following issues:

Security issue fixed:

  • CVE-2015-6806: Fixed a stack overflow due to deep recursion (bsc#944458).

Non-security issue fixed:

  • Fixed segmentation faults related to altscreen and resizing screen (bsc#1130831).
Record
SUSE-SU-2019:1354-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-6806 No score

The MScrollV function in ansi.c in GNU screen 4.3.1 and earlier does not properly limit recursion, which allows remote attackers to cause a denial of service (stack consumption) via an escape sequence with a large repeat count value.

Record
UBUNTU-CVE-2015-6806
Updated
2026-11-02
OSVUSN-3996-1 No score

GNU Screen vulnerability

Kuang-che Wu discovered that GNU Screen improperly handled certain input. An attacker could use this issue to cause GNU Screen to crash, resulting in a denial of service or the execution of arbitrary code.

Record
USN-3996-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
screen
Debian:12
 before 4.3.1-2
4.3.1-2
screen
Debian:13
 before 4.3.1-2
4.3.1-2
screen
Debian:14
 before 4.3.1-2
4.3.1-2
screen
Debian:6.0
 before 4.0.3-14+deb6u1, plus listed versions
4.0.3-14
4.0.3-14+deb6u1
screen
Debian:7
 before 4.1.0~20120320gitdb59704-7+deb7u1, plus listed versions
4.1.0~20120320gitdb59704-7
4.1.0~20120320gitdb59704-7+deb7u1
screen
Debian:8
 before 4.2.1-3+deb8u1, plus listed versions
4.2.1-3
4.2.1-3+deb8u1
screen
Mageia:4
 before 4.0.3-13.1.mga4
4.0.3-13.1.mga4
screen
Mageia:5
 before 4.2.1-3.1.mga5
4.2.1-3.1.mga5
screen
SUSE:Linux Enterprise Desktop 12 SP3
 before 4.0.4-23.3.3
4.0.4-23.3.3
screen
SUSE:Linux Enterprise Desktop 12 SP4
 before 4.0.4-23.3.3
4.0.4-23.3.3
Show 5 moreShow less
Affected packages
PackageAffectedFixed
screen
SUSE:Linux Enterprise Server 12 SP3
 before 4.0.4-23.3.3
4.0.4-23.3.3
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 4.0.4-23.3.3
4.0.4-23.3.3
screen
SUSE:Linux Enterprise Server 12 SP4
 before 4.0.4-23.3.3
4.0.4-23.3.3
screen
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 4.0.4-23.3.3
4.0.4-23.3.3
screen
Ubuntu:Pro:14.04:LTS
 before 4.1.0~20120320gitdb59704-9ubuntu0.1~esm1, plus listed versions
4.0.3-14ubuntu104.1.0~20120320gitdb59704-9
4.1.0~20120320gitdb59704-9ubuntu0.1~esm1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-6806 is a medium vulnerability (CVSS 5.0) in Gnu Screen, published September 4, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.15%, the 90th percentile. Fixed in screen 4.3.1-2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open