1343 matches found
PT-2023-5180
Name of the Vulnerable Software and Affected Versions ncurses versions prior to 6.4 20230408 Description The issue is related to security-relevant memory corruption via malformed data in a terminfo database file. This can be triggered by local users when the software is used by a setuid...
Medium: ncurses
Issue Overview: The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability...
Amazon Linux 2023 : ncurses, ncurses-base, ncurses-c++-libs (ALAS2023-2023-023)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-023 advisory. The ncurses package tic is susceptible to a heap overflow on crafted input. When the terminfo entry- description compiler processes input, proper bounds checking was not enforced leading to thi...
CBL Mariner 2.0 Security Update: ncurses (CVE-2022-29458)
The version of ncurses installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-29458 advisory. - ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convertstrings in...
SUSE CVE-2017-10684
In ncurses 6.0, there is a stack-based buffer overflow in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...
SUSE CVE-2017-10685
In ncurses 6.0, there is a format string vulnerability in the fmtentry function. A crafted input will lead to a remote arbitrary code execution attack...
SUSE CVE-2017-11112
In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the appendacs function of tinfo/parseentry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data...
SUSE CVE-2017-11113
In ncurses 6.0, there is a NULL Pointer Dereference in the ncparseentry function of tinfo/parseentry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data...
SUSE CVE-2017-13728
There is an infinite loop in the nextchar function in compscan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack...
SUSE CVE-2017-13729
There is an illegal address access in the ncsavestr function in allocentry.c in ncurses 6.0. It will lead to a remote denial of service attack...
SUSE CVE-2017-13730
There is an illegal address access in the function ncreadentrysource in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack...
SUSE CVE-2017-13731
There is an illegal address access in the function postprocesstermcap in parseentry.c in ncurses 6.0 that will lead to a remote denial of service attack...
SUSE CVE-2017-13733
There is an illegal address access in the fmtentry function in progs/dumpentry.c in ncurses 6.0 that might lead to a remote denial of service attack...
SUSE CVE-2017-13734
There is an illegal address access in the ncsafestrcat function in strings.c in ncurses 6.0 that will lead to a remote denial of service attack...
SUSE CVE-2017-13732
There is an illegal address access in the function dumpuses in progs/dumpentry.c in ncurses 6.0 that might lead to a remote denial of service attack...
SUSE CVE-2017-16879
Stack-based buffer overflow in the ncwriteentry function in tinfo/writeentry.c in ncurses 6.0 allows attackers to cause a denial of service application crash or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic...
SUSE CVE-2018-19211
In ncurses 6.1, there is a NULL pointer dereference at function ncparseentry in parseentry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character ' in name or alias field" detection...
SUSE CVE-2018-19217
In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function ncnamematch that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party...