Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
amazonAmazonALAS2-2022-1893
HistoryDec 01, 2022 - 8:31 p.m.

Medium: ncurses

2022-12-0120:31:00
alas.aws.amazon.com
8

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.2%

JSON

Issue Overview:

The ncurses package (tic) is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability. (CVE-2021-39537)

A segmentation fault vulnerability was found in ncurses’s convert_strings() function of tinfo/read_entry.c file. This flaw occurs due to corrupted terminfo data, triggering an out-of-bounds read error. (CVE-2022-29458)

Affected Packages:

ncurses

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update ncurses to update your system.

New Packages:

aarch64:  
    ncurses-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-libs-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-compat-libs-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-c++-libs-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-devel-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-static-6.0-8.20170212.amzn2.1.4.aarch64  
    ncurses-debuginfo-6.0-8.20170212.amzn2.1.4.aarch64  
  
i686:  
    ncurses-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-libs-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-compat-libs-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-c++-libs-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-devel-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-static-6.0-8.20170212.amzn2.1.4.i686  
    ncurses-debuginfo-6.0-8.20170212.amzn2.1.4.i686  
  
noarch:  
    ncurses-base-6.0-8.20170212.amzn2.1.4.noarch  
    ncurses-term-6.0-8.20170212.amzn2.1.4.noarch  
  
src:  
    ncurses-6.0-8.20170212.amzn2.1.4.src  
  
x86_64:  
    ncurses-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-libs-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-compat-libs-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-c++-libs-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-devel-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-static-6.0-8.20170212.amzn2.1.4.x86_64  
    ncurses-debuginfo-6.0-8.20170212.amzn2.1.4.x86_64

Additional References

Red Hat: CVE-2021-39537, CVE-2022-29458

Mitre: CVE-2021-39537, CVE-2022-29458

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64ncurses< 6.0-8.20170212.amzn2.1.4ncurses-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-libs< 6.0-8.20170212.amzn2.1.4ncurses-libs-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-compat-libs< 6.0-8.20170212.amzn2.1.4ncurses-compat-libs-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-c++-libs< 6.0-8.20170212.amzn2.1.4ncurses-c++-libs-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-devel< 6.0-8.20170212.amzn2.1.4ncurses-devel-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-static< 6.0-8.20170212.amzn2.1.4ncurses-static-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2aarch64ncurses-debuginfo< 6.0-8.20170212.amzn2.1.4ncurses-debuginfo-6.0-8.20170212.amzn2.1.4.aarch64.rpm
Amazon Linux2i686ncurses< 6.0-8.20170212.amzn2.1.4ncurses-6.0-8.20170212.amzn2.1.4.i686.rpm
Amazon Linux2i686ncurses-libs< 6.0-8.20170212.amzn2.1.4ncurses-libs-6.0-8.20170212.amzn2.1.4.i686.rpm
Amazon Linux2i686ncurses-compat-libs< 6.0-8.20170212.amzn2.1.4ncurses-compat-libs-6.0-8.20170212.amzn2.1.4.i686.rpm
Rows per page:
1-10 of 231

Related

nessus 37
openvas 36
suse 4
osv 6
alpinelinux 2
debiancve 2
cve 2
redhatcve 2
cbl_mariner 4
ubuntucve 2
cloudfoundry 1
prion 2
veracode 2
ubuntu 2
redos 1
debian 2
f5 1
photon 6
rosalinux 1
ibm 2
apple 3
avleonov 1
nessus
nessus
Amazon Linux 2022 : ncurses (ALAS2022-2022-217)
2022-12-09 00:00:00
Amazon Linux 2 : ncurses (ALAS-2022-1893)
2022-12-07 00:00:00
Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-023)
2023-03-21 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6099-1)
2023-05-24 00:00:00
openSUSE: Security Advisory for ncurses (openSUSE-SU-2021:3490-1)
2021-10-21 00:00:00
Huawei EulerOS: Security Advisory for ncurses (EulerOS-SA-2022-1406)
2022-04-13 00:00:00
suse
suse
Security update for ncurses (moderate)
2021-10-20 00:00:00
Security update for ncurses (moderate)
2021-10-31 00:00:00
Security update for ncurses (moderate)
2022-08-09 00:00:00
osv
osv
CVE-2021-39537
2021-09-20 16:15:12
CVE-2022-29458
2022-04-18 21:15:07
ncurses vulnerabilities
2023-05-23 11:56:42
alpinelinux
alpinelinux
CVE-2021-39537
2021-09-20 16:15:00
CVE-2022-29458
2022-04-18 21:15:00
debiancve
debiancve
CVE-2021-39537
2021-09-20 16:15:00
CVE-2022-29458
2022-04-18 21:15:00
cve
cve
CVE-2021-39537
2021-09-20 16:15:00
CVE-2022-29458
2022-04-18 21:15:00
redhatcve
redhatcve
CVE-2021-39537
2021-09-22 19:10:18
CVE-2022-29458
2022-04-19 07:58:07
cbl_mariner
cbl_mariner
CVE-2021-39537 affecting package ncurses 6.2-6
2021-11-06 00:29:52
CVE-2021-39537 affecting package ncurses 6.2-5
2022-04-26 19:57:37
CVE-2022-29458 affecting package ncurses 6.3-1
2022-10-05 23:33:40
ubuntucve
ubuntucve
CVE-2021-39537
2021-09-20 00:00:00
CVE-2022-29458
2022-04-18 00:00:00
cloudfoundry
cloudfoundry
USN-6099-1: ncurses vulnerabilities | Cloud Foundry
2023-06-05 00:00:00
prion
prion
Out-of-bounds
2022-04-18 21:15:00
Heap overflow
2021-09-20 16:15:00
veracode
veracode
Denial Of Service (DoS)
2021-12-09 17:11:49
Out-of-Bounds Read
2022-06-12 16:24:55
ubuntu
ubuntu
ncurses vulnerabilities
2023-05-23 00:00:00
ncurses vulnerabilities
2022-06-14 00:00:00
redos
redos
ROS-20231013-02
2023-10-13 00:00:00
debian
debian
[SECURITY] [DLA 3167-1] ncurses security update
2022-10-29 08:51:46
[SECURITY] [DLA 3682-1] ncurses security update
2023-12-03 18:46:35
f5
f5
K000138977 : ncurses vulnerability CVE-2022-29458
2024-03-21 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0192
2022-06-01 00:00:00
Important Photon OS Security Update - PHSA-2021-0445
2021-10-20 00:00:00
Important Photon OS Security Update - PHSA-2021-3.0-0314
2021-10-16 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2263
2023-10-22 05:30:45
ibm
ibm
Security Bulletin: IBM Automation Decision Services October 2023 - Multiple CVEs addressed
2023-10-30 14:35:14
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for October 2023
2023-11-24 15:07:23
apple
apple
About the security content of macOS Big Sur 11.7
2022-09-12 00:00:00
About the security content of macOS Monterey 12.6
2022-09-12 00:00:00
About the security content of macOS Ventura 13
2022-10-24 00:00:00
avleonov
avleonov
Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs
2022-12-30 18:03:13

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

80.2%

JSON
Related for ALAS2-2022-1893
nessus37openvas36suse4osv6alpinelinux2debiancve2cve2redhatcve2cbl_mariner4ubuntucve2cloudfoundry1prion2veracode2ubuntu2redos1debian2f51photon6rosalinux1ibm2apple3avleonov1