PT-2023-15133 · Tmux+4 · Tmux+4

Published 2023-01-20 · Updated 2024-06-15 · CVE-2022-47016

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tmux versions 3.0 through 3.3

Description A null pointer dereference issue was discovered in the window pane set event function in window.c, allowing attackers to cause denial of service or other unspecified impacts.

Recommendations For tmux versions 3.0 through 3.3, update to a version that includes the fix for the null pointer dereference in window.c. As a temporary workaround, consider restricting access to the window pane set event function until a patch is available.

Exploit

Fix

Related Identifiers

ALT-PU-2023-1196

CVE-2022-47016

MGASA-2023-0084

OESA-2023-1069

OESA-2023-1070

OPENSUSE-SU-2023_0220-1

OPENSUSE-SU-2024:12646-1

SUSE-RU-2024:0184-1

SUSE-SU-2023:0220-1

USN-5843-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Tmux

References · 28

• 🔥 https://github.com/tmux/tmux/issues/3312 · Exploit
• https://osv.dev/vulnerability/MGASA-2023-0084 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0084.html · Security Note
• https://osv.dev/vulnerability/USN-5843-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:0220-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12646-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1070 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5843-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-47016 · Security Note
• https://ubuntu.com/security/CVE-2022-47016 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-47016 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-47016 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2024:0184-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1069 · Vendor Advisory
• https://github.com/tmux/tmux/commit/e86752820993a00e3d28350cbe46878ba95d9012 · Note