var-202204-0632
Vulnerability from variot

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. ncurses Exists in an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state. (CVE-2019-17594). ========================================================================== Ubuntu Security Notice USN-6099-1 May 23, 2023

ncurses vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 23.04
  • Ubuntu 22.10
  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 LTS
  • Ubuntu 16.04 LTS (Available with Ubuntu Pro)
  • Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in ncurses.

Software Description: - ncurses: shared libraries for terminal handling

Details:

It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17594)

It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-17595)

It was discovered that ncurses was incorrectly handling end-of-string characters when converting between termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39537)

It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-29458)

It was discovered that ncurses was parsing environment variables when running with setuid applications and not properly handling the processing of malformed data when doing so. A local attacker could possibly use this issue to cause a denial of service (application crash) or execute arbitrary code. (CVE-2023-29491)

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04: lib32ncurses6 6.4-2ubuntu0.1 lib32ncursesw6 6.4-2ubuntu0.1 lib32tinfo6 6.4-2ubuntu0.1 lib64ncurses6 6.4-2ubuntu0.1 lib64ncursesw6 6.4-2ubuntu0.1 lib64tinfo6 6.4-2ubuntu0.1 libncurses5 6.4-2ubuntu0.1 libncurses6 6.4-2ubuntu0.1 libncursesw5 6.4-2ubuntu0.1 libncursesw6 6.4-2ubuntu0.1 libtinfo5 6.4-2ubuntu0.1 libtinfo6 6.4-2ubuntu0.1 ncurses-bin 6.4-2ubuntu0.1

Ubuntu 22.10: lib32ncurses6 6.3+20220423-2ubuntu0.1 lib32ncursesw6 6.3+20220423-2ubuntu0.1 lib32tinfo6 6.3+20220423-2ubuntu0.1 lib64ncurses6 6.3+20220423-2ubuntu0.1 lib64ncursesw6 6.3+20220423-2ubuntu0.1 lib64tinfo6 6.3+20220423-2ubuntu0.1 libncurses5 6.3+20220423-2ubuntu0.1 libncurses6 6.3+20220423-2ubuntu0.1 libncursesw5 6.3+20220423-2ubuntu0.1 libncursesw6 6.3+20220423-2ubuntu0.1 libtinfo5 6.3+20220423-2ubuntu0.1 libtinfo6 6.3+20220423-2ubuntu0.1 ncurses-bin 6.3+20220423-2ubuntu0.1

Ubuntu 22.04 LTS: lib32ncurses6 6.3-2ubuntu0.1 lib32ncursesw6 6.3-2ubuntu0.1 lib32tinfo6 6.3-2ubuntu0.1 lib64ncurses6 6.3-2ubuntu0.1 lib64ncursesw6 6.3-2ubuntu0.1 lib64tinfo6 6.3-2ubuntu0.1 libncurses5 6.3-2ubuntu0.1 libncurses6 6.3-2ubuntu0.1 libncursesw5 6.3-2ubuntu0.1 libncursesw6 6.3-2ubuntu0.1 libtinfo5 6.3-2ubuntu0.1 libtinfo6 6.3-2ubuntu0.1 ncurses-bin 6.3-2ubuntu0.1

Ubuntu 20.04 LTS: lib32ncurses6 6.2-0ubuntu2.1 lib32ncursesw6 6.2-0ubuntu2.1 lib32tinfo6 6.2-0ubuntu2.1 lib64ncurses6 6.2-0ubuntu2.1 lib64ncursesw6 6.2-0ubuntu2.1 lib64tinfo6 6.2-0ubuntu2.1 libncurses5 6.2-0ubuntu2.1 libncurses6 6.2-0ubuntu2.1 libncursesw5 6.2-0ubuntu2.1 libncursesw6 6.2-0ubuntu2.1 libtinfo5 6.2-0ubuntu2.1 libtinfo6 6.2-0ubuntu2.1 ncurses-bin 6.2-0ubuntu2.1

Ubuntu 18.04 LTS: lib32ncurses5 6.1-1ubuntu1.18.04.1 lib32ncursesw5 6.1-1ubuntu1.18.04.1 lib32tinfo5 6.1-1ubuntu1.18.04.1 lib64ncurses5 6.1-1ubuntu1.18.04.1 lib64tinfo5 6.1-1ubuntu1.18.04.1 libncurses5 6.1-1ubuntu1.18.04.1 libncursesw5 6.1-1ubuntu1.18.04.1 libtinfo5 6.1-1ubuntu1.18.04.1 libx32ncurses5 6.1-1ubuntu1.18.04.1 libx32ncursesw5 6.1-1ubuntu1.18.04.1 libx32tinfo5 6.1-1ubuntu1.18.04.1 ncurses-bin 6.1-1ubuntu1.18.04.1

Ubuntu 16.04 LTS (Available with Ubuntu Pro): lib32ncurses5 6.0+20160213-1ubuntu1+esm3 lib32ncursesw5 6.0+20160213-1ubuntu1+esm3 lib32tinfo5 6.0+20160213-1ubuntu1+esm3 lib64ncurses5 6.0+20160213-1ubuntu1+esm3 lib64tinfo5 6.0+20160213-1ubuntu1+esm3 libncurses5 6.0+20160213-1ubuntu1+esm3 libncursesw5 6.0+20160213-1ubuntu1+esm3 libtinfo5 6.0+20160213-1ubuntu1+esm3 libx32ncurses5 6.0+20160213-1ubuntu1+esm3 libx32ncursesw5 6.0+20160213-1ubuntu1+esm3 libx32tinfo5 6.0+20160213-1ubuntu1+esm3 ncurses-bin 6.0+20160213-1ubuntu1+esm3

Ubuntu 14.04 LTS (Available with Ubuntu Pro): lib32ncurses5 5.9+20140118-1ubuntu1+esm3 lib32ncursesw5 5.9+20140118-1ubuntu1+esm3 lib32tinfo5 5.9+20140118-1ubuntu1+esm3 lib64ncurses5 5.9+20140118-1ubuntu1+esm3 lib64tinfo5 5.9+20140118-1ubuntu1+esm3 libncurses5 5.9+20140118-1ubuntu1+esm3 libncursesw5 5.9+20140118-1ubuntu1+esm3 libtinfo5 5.9+20140118-1ubuntu1+esm3 libx32ncurses5 5.9+20140118-1ubuntu1+esm3 libx32ncursesw5 5.9+20140118-1ubuntu1+esm3 libx32tinfo5 5.9+20140118-1ubuntu1+esm3 ncurses-bin 5.9+20140118-1ubuntu1+esm3

In general, a standard system update will make all the necessary changes.

References: https://ubuntu.com/security/notices/USN-6099-1 CVE-2019-17594, CVE-2019-17595, CVE-2021-39537, CVE-2022-29458, CVE-2023-29491

Package Information: https://launchpad.net/ubuntu/+source/ncurses/6.4-2ubuntu0.1 https://launchpad.net/ubuntu/+source/ncurses/6.3+20220423-2ubuntu0.1 https://launchpad.net/ubuntu/+source/ncurses/6.3-2ubuntu0.1 https://launchpad.net/ubuntu/+source/ncurses/6.2-0ubuntu2.1 https://launchpad.net/ubuntu/+source/ncurses/6.1-1ubuntu1.18.04.1

. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202408-19

                                       https://security.gentoo.org/

Severity: Normal Title: ncurses: Multiple Vulnerabilities Date: August 09, 2024 Bugs: #839351, #904247 ID: 202408-19

Synopsis

Multiple vulnerabilities have been discovered in ncurses, the worst of which could lead to a denial of service.

Background

Free software emulation of curses in System V.

Affected packages

Package Vulnerable Unaffected

sys-libs/ncurses < 6.4_p20230408 >= 6.4_p20230408 sys-libs/ncurses-compat < 6.4_p20240330 >= 6.4_p20240330

Description

Multiple vulnerabilities have been discovered in ncurses. Please review the CVE identifiers referenced below for details.

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

Resolution

All ncurses users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=sys-libs/ncurses-6.4_p20230408" # emerge --ask --oneshot --verbose ">=sys-libs/ncurses-compat-6.4_p20240330"

References

[ 1 ] CVE-2022-29458 https://nvd.nist.gov/vuln/detail/CVE-2022-29458 [ 2 ] CVE-2023-29491 https://nvd.nist.gov/vuln/detail/CVE-2023-29491

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/202408-19

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

Copyright 2024 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202204-0632",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "ncurses",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "6.3"
      },
      {
        "model": "ncurses",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "gnu",
        "version": "6.3"
      },
      {
        "model": "macos",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "apple",
        "version": "13.0"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "10.0"
      },
      {
        "model": "ncurses",
        "scope": null,
        "trust": 0.8,
        "vendor": "gnu",
        "version": null
      },
      {
        "model": "macos",
        "scope": null,
        "trust": 0.8,
        "vendor": "\u30a2\u30c3\u30d7\u30eb",
        "version": null
      },
      {
        "model": "gnu/linux",
        "scope": null,
        "trust": 0.8,
        "vendor": "debian",
        "version": null
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "db": "PACKETSTORM",
        "id": "172500"
      }
    ],
    "trust": 0.2
  },
  "cve": "CVE-2022-29458",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2022-29458",
            "impactScore": 4.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 1.9,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "VHN-420992",
            "impactScore": 4.9,
            "integrityImpact": "NONE",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2022-29458",
            "impactScore": 5.2,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Local",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 7.1,
            "baseSeverity": "High",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2022-29458",
            "impactScore": null,
            "integrityImpact": "None",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "Required",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2022-29458",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2022-29458",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202204-3736",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-420992",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2022-29458",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. ncurses Exists in an out-of-bounds read vulnerability.Information is obtained and service operation is interrupted (DoS) It may be in a state. (CVE-2019-17594). ==========================================================================\nUbuntu Security Notice USN-6099-1\nMay 23, 2023\n\nncurses vulnerabilities\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 23.04\n- Ubuntu 22.10\n- Ubuntu 22.04 LTS\n- Ubuntu 20.04 LTS\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS (Available with Ubuntu Pro)\n- Ubuntu 14.04 LTS (Available with Ubuntu Pro)\n\nSummary:\n\nSeveral security issues were fixed in ncurses. \n\nSoftware Description:\n- ncurses: shared libraries for terminal handling\n\nDetails:\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS. \n(CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files. \nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. This issue only affected\nUbuntu 18.04 LTS. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. \n(CVE-2022-29458)\n\nIt was discovered that ncurses was parsing environment variables when\nrunning with setuid applications and not properly handling the\nprocessing of malformed data when doing so. A local attacker could\npossibly use this issue to cause a denial of service (application\ncrash) or execute arbitrary code. (CVE-2023-29491)\n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 23.04:\n   lib32ncurses6                   6.4-2ubuntu0.1\n   lib32ncursesw6                  6.4-2ubuntu0.1\n   lib32tinfo6                     6.4-2ubuntu0.1\n   lib64ncurses6                   6.4-2ubuntu0.1\n   lib64ncursesw6                  6.4-2ubuntu0.1\n   lib64tinfo6                     6.4-2ubuntu0.1\n   libncurses5                     6.4-2ubuntu0.1\n   libncurses6                     6.4-2ubuntu0.1\n   libncursesw5                    6.4-2ubuntu0.1\n   libncursesw6                    6.4-2ubuntu0.1\n   libtinfo5                       6.4-2ubuntu0.1\n   libtinfo6                       6.4-2ubuntu0.1\n   ncurses-bin                     6.4-2ubuntu0.1\n\nUbuntu 22.10:\n   lib32ncurses6                   6.3+20220423-2ubuntu0.1\n   lib32ncursesw6                  6.3+20220423-2ubuntu0.1\n   lib32tinfo6                     6.3+20220423-2ubuntu0.1\n   lib64ncurses6                   6.3+20220423-2ubuntu0.1\n   lib64ncursesw6                  6.3+20220423-2ubuntu0.1\n   lib64tinfo6                     6.3+20220423-2ubuntu0.1\n   libncurses5                     6.3+20220423-2ubuntu0.1\n   libncurses6                     6.3+20220423-2ubuntu0.1\n   libncursesw5                    6.3+20220423-2ubuntu0.1\n   libncursesw6                    6.3+20220423-2ubuntu0.1\n   libtinfo5                       6.3+20220423-2ubuntu0.1\n   libtinfo6                       6.3+20220423-2ubuntu0.1\n   ncurses-bin                     6.3+20220423-2ubuntu0.1\n\nUbuntu 22.04 LTS:\n   lib32ncurses6                   6.3-2ubuntu0.1\n   lib32ncursesw6                  6.3-2ubuntu0.1\n   lib32tinfo6                     6.3-2ubuntu0.1\n   lib64ncurses6                   6.3-2ubuntu0.1\n   lib64ncursesw6                  6.3-2ubuntu0.1\n   lib64tinfo6                     6.3-2ubuntu0.1\n   libncurses5                     6.3-2ubuntu0.1\n   libncurses6                     6.3-2ubuntu0.1\n   libncursesw5                    6.3-2ubuntu0.1\n   libncursesw6                    6.3-2ubuntu0.1\n   libtinfo5                       6.3-2ubuntu0.1\n   libtinfo6                       6.3-2ubuntu0.1\n   ncurses-bin                     6.3-2ubuntu0.1\n\nUbuntu 20.04 LTS:\n   lib32ncurses6                   6.2-0ubuntu2.1\n   lib32ncursesw6                  6.2-0ubuntu2.1\n   lib32tinfo6                     6.2-0ubuntu2.1\n   lib64ncurses6                   6.2-0ubuntu2.1\n   lib64ncursesw6                  6.2-0ubuntu2.1\n   lib64tinfo6                     6.2-0ubuntu2.1\n   libncurses5                     6.2-0ubuntu2.1\n   libncurses6                     6.2-0ubuntu2.1\n   libncursesw5                    6.2-0ubuntu2.1\n   libncursesw6                    6.2-0ubuntu2.1\n   libtinfo5                       6.2-0ubuntu2.1\n   libtinfo6                       6.2-0ubuntu2.1\n   ncurses-bin                     6.2-0ubuntu2.1\n\nUbuntu 18.04 LTS:\n   lib32ncurses5                   6.1-1ubuntu1.18.04.1\n   lib32ncursesw5                  6.1-1ubuntu1.18.04.1\n   lib32tinfo5                     6.1-1ubuntu1.18.04.1\n   lib64ncurses5                   6.1-1ubuntu1.18.04.1\n   lib64tinfo5                     6.1-1ubuntu1.18.04.1\n   libncurses5                     6.1-1ubuntu1.18.04.1\n   libncursesw5                    6.1-1ubuntu1.18.04.1\n   libtinfo5                       6.1-1ubuntu1.18.04.1\n   libx32ncurses5                  6.1-1ubuntu1.18.04.1\n   libx32ncursesw5                 6.1-1ubuntu1.18.04.1\n   libx32tinfo5                    6.1-1ubuntu1.18.04.1\n   ncurses-bin                     6.1-1ubuntu1.18.04.1\n\nUbuntu 16.04 LTS (Available with Ubuntu Pro):\n   lib32ncurses5                   6.0+20160213-1ubuntu1+esm3\n   lib32ncursesw5                  6.0+20160213-1ubuntu1+esm3\n   lib32tinfo5                     6.0+20160213-1ubuntu1+esm3\n   lib64ncurses5                   6.0+20160213-1ubuntu1+esm3\n   lib64tinfo5                     6.0+20160213-1ubuntu1+esm3\n   libncurses5                     6.0+20160213-1ubuntu1+esm3\n   libncursesw5                    6.0+20160213-1ubuntu1+esm3\n   libtinfo5                       6.0+20160213-1ubuntu1+esm3\n   libx32ncurses5                  6.0+20160213-1ubuntu1+esm3\n   libx32ncursesw5                 6.0+20160213-1ubuntu1+esm3\n   libx32tinfo5                    6.0+20160213-1ubuntu1+esm3\n   ncurses-bin                     6.0+20160213-1ubuntu1+esm3\n\nUbuntu 14.04 LTS (Available with Ubuntu Pro):\n   lib32ncurses5                   5.9+20140118-1ubuntu1+esm3\n   lib32ncursesw5                  5.9+20140118-1ubuntu1+esm3\n   lib32tinfo5                     5.9+20140118-1ubuntu1+esm3\n   lib64ncurses5                   5.9+20140118-1ubuntu1+esm3\n   lib64tinfo5                     5.9+20140118-1ubuntu1+esm3\n   libncurses5                     5.9+20140118-1ubuntu1+esm3\n   libncursesw5                    5.9+20140118-1ubuntu1+esm3\n   libtinfo5                       5.9+20140118-1ubuntu1+esm3\n   libx32ncurses5                  5.9+20140118-1ubuntu1+esm3\n   libx32ncursesw5                 5.9+20140118-1ubuntu1+esm3\n   libx32tinfo5                    5.9+20140118-1ubuntu1+esm3\n   ncurses-bin                     5.9+20140118-1ubuntu1+esm3\n\nIn general, a standard system update will make all the necessary changes. \n\nReferences:\n   https://ubuntu.com/security/notices/USN-6099-1\n   CVE-2019-17594, CVE-2019-17595, CVE-2021-39537, CVE-2022-29458,\n   CVE-2023-29491\n\nPackage Information:\n   https://launchpad.net/ubuntu/+source/ncurses/6.4-2ubuntu0.1\nhttps://launchpad.net/ubuntu/+source/ncurses/6.3+20220423-2ubuntu0.1\n   https://launchpad.net/ubuntu/+source/ncurses/6.3-2ubuntu0.1\n   https://launchpad.net/ubuntu/+source/ncurses/6.2-0ubuntu2.1\nhttps://launchpad.net/ubuntu/+source/ncurses/6.1-1ubuntu1.18.04.1\n\n. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202408-19\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: ncurses: Multiple Vulnerabilities\n     Date: August 09, 2024\n     Bugs: #839351, #904247\n       ID: 202408-19\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n=======\nMultiple vulnerabilities have been discovered in ncurses, the worst of\nwhich could lead to a denial of service. \n\nBackground\n=========\nFree software emulation of curses in System V. \n\nAffected packages\n================\nPackage                  Vulnerable       Unaffected\n-----------------------  ---------------  ----------------\nsys-libs/ncurses         \u003c 6.4_p20230408  \u003e= 6.4_p20230408\nsys-libs/ncurses-compat  \u003c 6.4_p20240330  \u003e= 6.4_p20240330\n\nDescription\n==========\nMultiple vulnerabilities have been discovered in ncurses. Please review\nthe CVE identifiers referenced below for details. \n\nImpact\n=====\nPlease review the referenced CVE identifiers for details. \n\nWorkaround\n=========\nThere is no known workaround at this time. \n\nResolution\n=========\nAll ncurses users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=sys-libs/ncurses-6.4_p20230408\"\n  # emerge --ask --oneshot --verbose \"\u003e=sys-libs/ncurses-compat-6.4_p20240330\"\n\nReferences\n=========\n[ 1 ] CVE-2022-29458\n      https://nvd.nist.gov/vuln/detail/CVE-2022-29458\n[ 2 ] CVE-2023-29491\n      https://nvd.nist.gov/vuln/detail/CVE-2023-29491\n\nAvailability\n===========\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202408-19\n\nConcerns?\n========\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n======\nCopyright 2024 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "db": "PACKETSTORM",
        "id": "172500"
      },
      {
        "db": "PACKETSTORM",
        "id": "180043"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-29458",
        "trust": 3.7
      },
      {
        "db": "PACKETSTORM",
        "id": "167488",
        "trust": 0.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766",
        "trust": 0.8
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5451",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2022.5300",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2023.3001",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-420992",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "172500",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "180043",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "db": "PACKETSTORM",
        "id": "172500"
      },
      {
        "db": "PACKETSTORM",
        "id": "180043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "id": "VAR-202204-0632",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2024-11-23T20:26:44.082000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "HT213488",
        "trust": 0.8,
        "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html"
      },
      {
        "title": "Debian CVElist Bug Report Logs: ncurses: CVE-2022-29458",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_cvelist_bugreportlogs\u0026qid=45c96f9efcbf1f005965c804ad562312"
      },
      {
        "title": "Ubuntu Security Notice: USN-5477-1: ncurses vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=USN-5477-1"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2022-1893",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=ALAS2-2022-1893"
      },
      {
        "title": "Amazon Linux 2022: ALAS-2022-217",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2022\u0026qid=ALAS-2022-217"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/adegoodyer/ubuntu "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/adegoodyer/kubernetes-admin-toolkit "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/oshawa-connection/vulnerableapp "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-125",
        "trust": 1.1
      },
      {
        "problemtype": "Out-of-bounds read (CWE-125) [NVD evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.8,
        "url": "https://support.apple.com/kb/ht213488"
      },
      {
        "trust": 1.8,
        "url": "http://seclists.org/fulldisclosure/2022/oct/41"
      },
      {
        "trust": 1.8,
        "url": "https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.html"
      },
      {
        "trust": 1.8,
        "url": "https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.html"
      },
      {
        "trust": 1.8,
        "url": "https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html"
      },
      {
        "trust": 1.1,
        "url": "http://seclists.org/fulldisclosure/2022/oct/28"
      },
      {
        "trust": 1.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2022-29458"
      },
      {
        "trust": 0.6,
        "url": "https://cxsecurity.com/cveshow/cve-2022-29458/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5451"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2022.5300"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/ncurses-out-of-bounds-memory-reading-via-convert-strings-38580"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/167488/ubuntu-security-notice-usn-5477-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://support.apple.com/en-us/ht213488"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2023.3001"
      },
      {
        "trust": 0.2,
        "url": "https://ubuntu.com/security/notices/usn-5477-1"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17594"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17595"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2021-39537"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2023-29491"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/125.html"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009870"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-16879"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-19211"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ncurses/6.1-1ubuntu1.18.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ncurses/6.4-2ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ncurses/6.3-2ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ncurses/6.3+20220423-2ubuntu0.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/ncurses/6.2-0ubuntu2.1"
      },
      {
        "trust": 0.1,
        "url": "https://ubuntu.com/security/notices/usn-6099-1"
      },
      {
        "trust": 0.1,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.1,
        "url": "https://security.gentoo.org/glsa/202408-19"
      },
      {
        "trust": 0.1,
        "url": "https://bugs.gentoo.org."
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "db": "PACKETSTORM",
        "id": "172500"
      },
      {
        "db": "PACKETSTORM",
        "id": "180043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "db": "PACKETSTORM",
        "id": "172500"
      },
      {
        "db": "PACKETSTORM",
        "id": "180043"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-04-18T00:00:00",
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "date": "2022-04-18T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "date": "2023-08-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "date": "2022-06-19T16:42:23",
        "db": "PACKETSTORM",
        "id": "167488"
      },
      {
        "date": "2023-05-23T13:56:02",
        "db": "PACKETSTORM",
        "id": "172500"
      },
      {
        "date": "2024-08-09T15:12:20",
        "db": "PACKETSTORM",
        "id": "180043"
      },
      {
        "date": "2022-04-18T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "date": "2022-04-18T21:15:07.600000",
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-11-08T00:00:00",
        "db": "VULHUB",
        "id": "VHN-420992"
      },
      {
        "date": "2022-11-08T00:00:00",
        "db": "VULMON",
        "id": "CVE-2022-29458"
      },
      {
        "date": "2023-08-08T07:21:00",
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      },
      {
        "date": "2023-05-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      },
      {
        "date": "2024-11-21T06:59:07.650000",
        "db": "NVD",
        "id": "CVE-2022-29458"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ncurses\u00a0 Out-of-bounds read vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2022-009766"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202204-3736"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.