9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.022 Low
EPSS
Percentile
89.2%
Issue Overview:
In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data. (CVE-2017-11112)
In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data. (CVE-2017-11113)
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. (CVE-2017-10684)
In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack. (CVE-2017-10685)
Affected Packages:
ncurses
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update ncurses to update your system.
New Packages:
aarch64:
ncurses-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-libs-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-compat-libs-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-c++-libs-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-devel-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-static-6.0-8.20170212.amzn2.1.3.aarch64
ncurses-debuginfo-6.0-8.20170212.amzn2.1.3.aarch64
i686:
ncurses-6.0-8.20170212.amzn2.1.3.i686
ncurses-libs-6.0-8.20170212.amzn2.1.3.i686
ncurses-compat-libs-6.0-8.20170212.amzn2.1.3.i686
ncurses-c++-libs-6.0-8.20170212.amzn2.1.3.i686
ncurses-devel-6.0-8.20170212.amzn2.1.3.i686
ncurses-static-6.0-8.20170212.amzn2.1.3.i686
ncurses-debuginfo-6.0-8.20170212.amzn2.1.3.i686
noarch:
ncurses-base-6.0-8.20170212.amzn2.1.3.noarch
ncurses-term-6.0-8.20170212.amzn2.1.3.noarch
src:
ncurses-6.0-8.20170212.amzn2.1.3.src
x86_64:
ncurses-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-libs-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-compat-libs-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-c++-libs-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-devel-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-static-6.0-8.20170212.amzn2.1.3.x86_64
ncurses-debuginfo-6.0-8.20170212.amzn2.1.3.x86_64
Red Hat: CVE-2017-10684, CVE-2017-10685, CVE-2017-11112, CVE-2017-11113
Mitre: CVE-2017-10684, CVE-2017-10685, CVE-2017-11112, CVE-2017-11113
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.2 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.022 Low
EPSS
Percentile
89.2%