CVE-2017-16879

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

Possible RCE via stack-based buffer overflow in the fmt_entry function (CVE-2017-10684).

Possible RCE with format string vulnerability in the fmt_entry function (CVE-2017-10685).

Illegal address access in append_acs (CVE-2017-11112).

Dereferencing NULL pointer in _nc_parse_entry (CVE-2017-11113).

Fix infinite loop in the next_char function in comp_scan.c (CVE-2017-13728).

Fix illegal address access in the _nc_save_str (CVE-2017-13729).

Fix illegal address access in the function _nc_read_entry_source() (CVE-2017-13730).

Fix illegal address access in the function postprocess_termcap() (CVE-2017-13731).

Fix illegal address access in the function dump_uses() (CVE-2017-13732).

Fix illegal address access in the fmt_entry function (CVE-2017-13733).

Fix stack-based buffer overflow in the _nc_write_entry() function (CVE-2017-16879).

This update for ncurses fixes the following issues:

Security issues fixed:

• CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136).
• CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132).
• CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131).
• CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129).
• CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128).
• CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127).
• CVE-2017-16879: Fix stack-based buffer overflow in the _nc_write_entry() function (bsc#1069530).

Hosein Askari discovered that ncurses was incorrectly performing memory management operations when dealing with long filenames while writing structures into the file system. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-16879)

Chung-Yi Lin discovered that ncurses was incorrectly handling access to invalid memory areas when parsing terminfo or termcap entries where the use-name had invalid syntax. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19211)

It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17594)

It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17595)

It was discovered that ncurses was incorrectly handling end-of-string characters when converting between termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-39537)

It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2022-29458)