{"id":"CVE-2017-16879","aliases":["ALPINE-CVE-2017-16879","BELL-CVE-2017-16879","DEBIAN-CVE-2017-16879","EUVD-2017-8051","GHSA-r8vx-h3vx-6wh2","MGASA-2018-0002","SUSE-SU-2017:3183-1","UBUNTU-CVE-2017-16879","USN-5477-1"],"status":"published","title":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0...","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02392,"percentile":0.84091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2017-11-22T22:00:00Z","modified":"2026-09-01T20:03:45Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"ncurses","fixed_in":["6.0_p20171125-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ncurses","fixed_in":["6.0+20171125-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ncurses","fixed_in":["6.0+20171125-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ncurses","fixed_in":["6.0+20171125-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","fixed_in":["5.9+20140118-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","fixed_in":["6.0+20160213-1ubuntu1+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0_p20171125-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20171125-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20171125-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20171125-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0-8.1.mga6"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6-93.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6-93.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6-93.12.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"],"bundled":6}],"products":[{"vendor":"invisible-island","product":"ncurses"}],"references":[{"url":"http://packetstormsecurity.com/files/145045/GNU-ncurses-6.0-tic-Denial-Of-Service.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://security.gentoo.org/glsa/201804-13","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://invisible-island.net/ncurses/NEWS.html#t20171125","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://tools.cisco.com/security/center/viewAlert.x?alertId=57695","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","Third Party Advisory","report"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16879"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-r8vx-h3vx-6wh2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-16879","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-16879","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16879","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0002.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21197","tags":["report"]},{"url":"http://invisible-island.net/ncurses/NEWS.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-07/msg00071.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-08/msg00048.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00002.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173183-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056127","tags":["report"]},{"url":"https://bugzilla.suse.com/1056128","tags":["report"]},{"url":"https://bugzilla.suse.com/1056129","tags":["report"]},{"url":"https://bugzilla.suse.com/1056131","tags":["report"]},{"url":"https://bugzilla.suse.com/1056132","tags":["report"]},{"url":"https://bugzilla.suse.com/1056136","tags":["report"]},{"url":"https://bugzilla.suse.com/1069530","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16879","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-16879","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5477-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-39537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29458","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:00:00Z","modified":"2024-08-05T20:35:21.226Z","updated_at":"2026-11-02T14:33:21.142987Z"}],"euvd":[{"id":"EUVD-2017-8051","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:00:00Z","modified":"2024-08-05T20:35:21Z","updated_at":"2026-11-03T02:23:11.533108Z"}],"ghsa":[{"id":"GHSA-r8vx-h3vx-6wh2","title":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0...","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2022-05-13T01:09:01Z","modified":"2025-04-20T03:50:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:29:00.223Z","modified":"2026-07-23T18:58:25.76Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"ALPINE-CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:29:00.223Z","modified":"2026-06-15T18:18:06.777481077Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-16879","title":"CVE-2017-16879 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:28.202096Z","modified":"2026-01-26T09:46:47.732655Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:29:00.223Z","modified":"2026-07-08T11:35:37.483256Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:29:00.223Z","modified":"2026-09-01T20:03:45.267284627Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-16879","description":"Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.","status":"published","published":"2017-11-22T22:29:00Z","modified":"2026-04-22T11:19:51.856214Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"MGASA-2018-0002","title":"Updated ncurses packages fix security vulnerabilities","description":"Possible RCE via stack-based buffer overflow in the fmt_entry function\n(CVE-2017-10684).\n\nPossible RCE with format string vulnerability in the fmt_entry function\n(CVE-2017-10685).\n\nIllegal address access in append_acs (CVE-2017-11112).\n\nDereferencing NULL pointer in _nc_parse_entry (CVE-2017-11113).\n\nFix infinite loop in the next_char function in comp_scan.c\n(CVE-2017-13728).\n\nFix illegal address access in the _nc_save_str (CVE-2017-13729).\n\nFix illegal address access in the function _nc_read_entry_source()\n(CVE-2017-13730).\n\nFix illegal address access in the function postprocess_termcap()\n(CVE-2017-13731).\n\nFix illegal address access in the function dump_uses() (CVE-2017-13732).\n\nFix illegal address access in the fmt_entry function (CVE-2017-13733).\n\nFix stack-based buffer overflow in the _nc_write_entry() function\n(CVE-2017-16879).\n","status":"published","published":"2018-01-01T01:17:34Z","modified":"2026-04-16T06:24:41.529629476Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:3183-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-13728: Fix infinite loop in the next_char function in comp_scan.c (bsc#1056136).\n- CVE-2017-13729: Fix illegal address access in the _nc_save_str (bsc#1056132).\n- CVE-2017-13730: Fix illegal address access in the function _nc_read_entry_source() (bsc#1056131).\n- CVE-2017-13731: Fix illegal address access in the function postprocess_termcap() (bsc#1056129).\n- CVE-2017-13732: Fix illegal address access in the function dump_uses() (bsc#1056128).\n- CVE-2017-13733: Fix illegal address access in the fmt_entry function (bsc#1056127).\n- CVE-2017-16879: Fix stack-based buffer overflow in the _nc_write_entry() function (bsc#1069530).\n","status":"published","published":"2017-12-01T14:06:18Z","modified":"2026-02-04T03:38:58.350564Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-5477-1","title":"ncurses vulnerabilities","description":"Hosein Askari discovered that ncurses was incorrectly performing\nmemory management operations when dealing with long filenames while\nwriting structures into the file system. An attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary\ncode. (CVE-2017-16879)\n\nChung-Yi Lin discovered that ncurses was incorrectly handling access\nto invalid memory areas when parsing terminfo or termcap entries where\nthe use-name had invalid syntax. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2018-19211)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. (CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files.\nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information.\n(CVE-2022-29458)\n","status":"published","published":"2022-06-14T11:17:52Z","modified":"2026-06-29T13:49:39.254663481Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}