{"id":"CVE-2022-47016","aliases":["EUVD-2022-49794","GHSA-59wm-qx44-pj6w","MGASA-2023-0084","OESA-2023-1069","OESA-2023-1070","SUSE-RU-2024:0184-1","SUSE-SU-2023:0220-1","UBUNTU-CVE-2022-47016","USN-5843-1","openSUSE-SU-2024:12646-1"],"status":"rejected","title":"A null pointer dereference issue was discovered in function window_pane_set_event in window.c in...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2023-01-20T19:15:00Z","modified":"2026-08-18T01:17:30Z","fixes":[{"ecosystem":"Mageia:8","package":"tmux","fixed_in":["3.1c-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tmux","fixed_in":["3.2a-3.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"tmux","fixed_in":["3.2a-3.oe2203sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"tmux","fixed_in":["3.3a-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tmux","fixed_in":["3.3a-150300.3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tmux","fixed_in":["3.1c-150300.3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tmux","fixed_in":["1.8-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tmux","fixed_in":["2.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"tmux","fixed_in":["2.6-3ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"tmux","fixed_in":["3.0a-2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tmux","fixed_in":["3.2a-4ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tmux","fixed_in":["3.3a-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:8","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1c-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2a-3.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2a-3.oe2203sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3a-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3a-150300.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1c-150300.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-5ubuntu0.1~esm1"}]}],"versions":["1.8-4","1.8-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-3ubuntu0.1~esm1"}]}],"versions":["2.0-3","2.1-1","2.1-2","2.1-3","2.1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-3ubuntu0.3"}]}],"versions":["2.5-3build1","2.6-1","2.6-2","2.6-3","2.6-3ubuntu0.1","2.6-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0a-2ubuntu0.4"}]}],"versions":["2.9a-3build1","2.9a-3build2","3.0-1","3.0a-1","3.0a-2","3.0a-2ubuntu0.1","3.0a-2ubuntu0.2","3.0a-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2a-4ubuntu0.2"}]}],"versions":["3.1c-1build1","3.2a-4","3.2a-4build1","3.2a-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8-5ubuntu0.1~esm1"}]}],"versions":["1.8-4","1.8-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1-3ubuntu0.1~esm1"}]}],"versions":["2.0-3","2.1-1","2.1-2","2.1-3","2.1-3build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6-3ubuntu0.3"}]}],"versions":["2.5-3build1","2.6-1","2.6-2","2.6-3","2.6-3ubuntu0.1","2.6-3ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0a-2ubuntu0.4"}]}],"versions":["2.9a-3build1","2.9a-3build2","3.0-1","3.0a-1","3.0a-2","3.0a-2ubuntu0.1","3.0a-2ubuntu0.2","3.0a-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2a-4ubuntu0.2"}]}],"versions":["3.1c-1build1","3.2a-4","3.2a-4build1","3.2a-4ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tmux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3a-2.1"}]}]}],"references":[{"url":"https://www.suse.com/security/cve/CVE-2022-47016.html"},{"url":"https://ubuntu.com/security/CVE-2022-47016","tags":["report"]},{"url":"https://advisories.mageia.org/CVE-2022-47016.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-47016","tags":["advisory"]},{"url":"https://github.com/tmux/tmux/issues/3312","tags":["report"]},{"url":"https://github.com/tmux/tmux/issues/3447","tags":["report"]},{"url":"https://github.com/advisories/GHSA-59wm-qx44-pj6w"},{"url":"https://advisories.mageia.org/MGASA-2023-0084.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31498","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2023-February/013614.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RLXFZY2LCNARDYLW75IRAC42GRUF4DMZ/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5843-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1069","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1070","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2024-184/suse-ru-20240184-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185572","tags":["report"]},{"url":"https://bugzilla.suse.com/1207393","tags":["report"]},{"url":"https://bugzilla.suse.com/1210552","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-47016","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230220-1/","tags":["advisory"]},{"url":"https://github.com/tmux/tmux/commit/e86752820993a00e3d28350cbe46878ba95d9012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-47016","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-47016","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","modified":"2023-02-13T00:00:00Z","updated_at":"2026-11-02T14:34:24.971323Z"}],"euvd":[{"id":"EUVD-2022-49794","description":"A null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 allows attackers to cause denial of service or other unspecified impacts.","status":"published","published":"2023-01-20T21:30:30Z","modified":"2023-01-27T15:30:32Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:51:02.023275Z"}],"ghsa":[{"id":"GHSA-59wm-qx44-pj6w","title":"A null pointer dereference issue was discovered in function window_pane_set_event in window.c in...","description":"A null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 allows attackers to cause denial of service or other unspecified impacts.","status":"published","published":"2023-01-20T21:30:30Z","modified":"2023-02-04T05:06:33Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:53:58.500745Z"}],"nvd":[{"id":"CVE-2022-47016","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2023-01-20T19:15:17.497Z","modified":"2023-11-07T03:56:06.313Z","updated_at":"2026-11-02T14:07:35.157734Z"}],"osv":[{"id":"OESA-2023-1069","title":"tmux security update","description":"is a terminal multiplexer. It lets you switch easily between several programs in one terminal, detach them (they keep running in the background) and reattach them to a different terminal.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 and later, allows attackers to cause denial of service or other unspecified impacts.(CVE-2022-47016)","status":"published","published":"2023-02-10T11:05:32Z","modified":"2026-08-18T01:17:30.175805446Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1070","title":"tmux security update","description":"is a terminal multiplexer. It lets you switch easily between several programs in one terminal, detach them (they keep running in the background) and reattach them to a different terminal.\r\n\r\nSecurity Fix(es):\r\n\r\nA null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 and later, allows attackers to cause denial of service or other unspecified impacts.(CVE-2022-47016)","status":"published","published":"2023-02-10T11:05:33Z","modified":"2026-08-18T01:17:30.665465151Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-47016","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2023-01-20T19:15:00Z","modified":"2026-02-04T03:37:58.997772Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"MGASA-2023-0084","title":"Updated tmux packages fix security vulnerability","description":"Fixed a null pointer dereference in window.c. (CVE-2022-47016)\n","status":"published","published":"2023-03-11T19:00:39Z","modified":"2026-04-16T04:41:43.05730975Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12646-1","title":"tmux-3.3a-2.1 on GA media","description":"These are all security issues fixed in the tmux-3.3a-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:01:19.509344Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-RU-2024:0184-1","title":"Recommended update for tmux","description":"This update for tmux fixes the following issues:\n\n- tmux: Null pointer dereference in window.c (bsc#1207393) (CVE-2022-47016)\n- add patch for compactibility with new ncurses fixes bsc#1210552\n- disable utf8proc (following upstreams not use it by default on non-macOS) \n- switch to screen-256color as default terminal to fix incompatibility\n  with yast2-ruby-testsuite \n- update to 3.3a:\n- build with utf8proc enabled\n- refresh tmux-socket-path patch: \n  restore ability to overwrite socket path using $TMUX_TMPDIR (bsc#1185572)\n- Drop pkgconfig(systemd) BuildRequires: there is no reason to pull\n  in systemd into the build.\n- Use %tmpfiles_create instead of calling systemd-tmpfiles\n  directly.\n- Replace systemd_requires with systemd_ordering: tmux is very well\n  capable to run without systemd (and by using tmpfiles_create, the\n  post script can also cope with the absence of if).","status":"published","published":"2024-01-23T12:04:14Z","modified":"2025-05-02T04:10:57.696714Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2023:0220-1","title":"Security update for tmux","description":"This update for tmux fixes the following issues:\n\n- CVE-2022-47016: Fixed a null pointer dereference in window.c. (bsc#1207393)\n","status":"published","published":"2023-02-01T08:33:49Z","modified":"2026-02-04T02:15:23.853463Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5843-1","title":"tmux vulnerability","description":"It was discovered that tmux incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2023-02-06T16:27:18Z","modified":"2026-06-29T13:50:46.811573967Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}