Re: screen 5.0.1 update for review

[Thomas Klausner <wiz%NetBSD.org@localhost>]

On Thu, May 15, 2025 at 01:54:19PM +0000, Emmanuel Dreyfus wrote:
> Anyone wants to review the attached pkgsrc/misc/screen update to 5.0.1? 

Which of the two tarballs of the same name does that package? (see below)

Perhaps we should wait for 5.0.2.
 Thomas

--- Begin Message ---

• To: oss-security%lists.openwall.com@localhost
• Subject: Re: [oss-security] screen: Multiple Security Issues in Screen (mostly affecting release 5.0.0 and setuid-root installations)
• From: Stuart Henderson <stu%spacehopper.org@localhost>
• Date: Thu, 15 May 2025 16:09:51 +0100

On 2025/05/14 13:26, Matthias Gerstner wrote:
> Hi,
> 
> On Tue, May 13, 2025 at 03:48:31PM -0700, Mark Esler wrote:
> > Cheers for the report Matthias and SUSE Security!
> 
> thanks!
> 
> > Could you please comment on the affectedness of upstream screen 5.0.1?
> > 
> > https://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v5&id=464c8d8f945f53f8cbb854517279349e09d74756
> > 
> > This version was released ~an hour before your initial oss post. It appears
> > that upstream landed the patches, which may be worth mentioning in your
> > timeline.
> 
> Indeed, this is the bugfix release announced by upstream here:
> 
> https://lists.gnu.org/archive/html/screen-users/2025-05/msg00005.html

There are two different versions of the tar.gz; at present, some of the
gnu.org mirrors have one, some have another. The earlier one includes
.o and other generated files, also there are differences to some source
and headers around WINESC_WIN_CARET.

It would probably be helpful to make a 5.0.2 release to make it a little
more clear.

--- End Message ---