CVE-2020-27347

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

In tmux before version 3.1c the function input_csi_dispatch_sgr_colon() in file input.c contained a stack-based buffer-overflow that can be exploited by terminal output.

This update for tmux fixes the following issues:

• Update to version 3.1c

  • Fix a stack overflow on colon-separated CSI parsing. boo#1178263 CVE-2020-27347

• tmux 3.1b:

  • Fix crash when allow-rename ison and an empty name is set

• tmux 3.1a:

  • Do not close stdout prematurely in control mode since it is needed to print exit messages. Prevents hanging when detaching with iTerm2

• includes changes between 3.1-rc1 and 3.1:

  • Only search the visible part of the history when marking (highlighting) search terms. This is much faster than searching the whole history and solves problems with large histories. The count of matches shown is now the visible matches rather than all matches
  • Search using regular expressions in copy mode. search-forward and search-backward use regular expressions by default; the incremental versions do not
  • Turn off mouse mode 1003 as well as the rest when exiting
  • Add selection_active format for when the selection is present but not moving with the cursor
  • Fix dragging with modifier keys, so binding keys such as C-MouseDrag1Pane and C-MouseDragEnd1Pane now work
  • Add -a to list-keys to also list keys without notes with -N
  • Do not jump to next word end if already on a word end when selecting a word; fixes select-word with single character words and vi(1) keys
  • Fix top and bottom pane calculation with pane border status enabled

• Update to v3.1-rc

  • Please see the included CHANGES file

• Fix tmux completion

• Update to v3.0a

  • A lot of changes since v2.9a, please see the included CHANGES file.

• Update to v2.9a

  • Fix bugs in select-pane and the main-horizontal and main-vertical layouts.

• Add trailing newline to tmpfiles.d/tmux.conf. On newer systems (such as Leap 15.1), the lack of a trailing newline appears to cause the directory to not be created. This is only evident on setups where /run is an actual tmpfs (on btrfs-root installs, /run is a btrfs subvolume and thus /run/tmux is persistent across reboots).

• Update to version 2.9

  • Add format variables for the default formats in the various modes (tree_mode_format and so on) and add a -a flag to display-message to list variables with values.
  • Add a -v flag to display-message to show verbose messages as the format is parsed, this allows formats to be debugged
  • Add support for HPA (\033[`).
  • Add support for origin mode (\033[?6h).
  • No longer clear history on RIS.
  • Extend the #[] style syntax and use that together with previous format changes to allow the status line to be entirely configured with a single option.
  • Add E: and T: format modifiers to expand a format twice (useful to expand the value of an option).
  • The individual -fg, -bg and -attr options have been removed; they were superseded by -style options in tmux 1.9.
  • Add -b to display-panes like run-shell.
  • Handle UTF-8 in word-separators option.
  • New 'terminal' colour allowing options to use the terminal default colour rather than inheriting the default from a parent option.
  • Do not move the cursor in copy mode when the mouse wheel is used.
  • Use the same working directory rules for jobs as new windows rather than always starting in the user's home.
  • Allow panes to be one line or column in size.
  • Go to last line when goto-line number is out of range in copy mode.
  • Yank previously cut text if any with C-y in the command prompt, only use the buffer if no text has been cut.
  • Add q: format modifier to quote shell special characters.
  • Add -Z to find-window.
  • Support for windows larger than the client. This adds two new options, window-size and default-size, and a new command, resize-window. The force-width and force-height options and the session_width and session_height formats have been removed.

• update to 2.8

• move bash-completion to right place

• Make display-panes block the client…

These are all security issues fixed in the tmux-3.2a-1.2 package on the GA media of openSUSE Tumbleweed.

Sergey Nizovtsev discovered that tmux incorrectly handled some inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code.