{"id":"CVE-2019-17595","aliases":["ALSA-2021:4426","DEBIAN-CVE-2019-17595","EUVD-2019-7923","GHSA-mhrh-92mr-7rw4","JLSEC-2026-444","MGASA-2019-0387","RHSA-2021:4426","RLSA-2021:4426","SUSE-SU-2019:2997-1","SUSE-SU-2019:3094-1","UBUNTU-CVE-2019-17595","USN-5477-1","USN-6099-1","openSUSE-SU-2019:2550-1","openSUSE-SU-2019:2551-1"],"status":"published","title":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the...","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02224,"percentile":0.82819,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-10-14T20:42:57Z","modified":"2026-10-29T11:01:44Z","fixes":[{"ecosystem":"Debian:12","package":"ncurses","fixed_in":["6.1+20191019-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ncurses","fixed_in":["6.1+20191019-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ncurses","fixed_in":["6.1+20191019-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Ncurses_jll","fixed_in":["6.2.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","fixed_in":["5.9+20140118-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","fixed_in":["6.0+20160213-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","fixed_in":["6.1-1ubuntu1.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","fixed_in":["6.1+20191019-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-c++-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-compat-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"ncurses-term","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1+20191019-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1+20191019-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1+20191019-1"}]}]},{"source":"osv","ecosystem":"Julia","package":"Ncurses_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.2.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-20181117.3.1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-c++-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-c++-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-compat-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-compat-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ncurses-term","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1-9.20180224.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-69.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1ubuntu1.18.04.1"}]}],"versions":["6.0+20160625-1ubuntu1","6.0+20171125-1ubuntu1","6.1-1ubuntu1","6.1-1ubuntu1.18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1+20191019-1ubuntu1"}]}],"versions":["6.1+20190803-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm3"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1","5.9+20140118-1ubuntu1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm3"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1","6.0+20160213-1ubuntu1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1ubuntu1.18.04.1"}]}],"versions":["6.0+20160625-1ubuntu1","6.0+20171125-1ubuntu1","6.1-1ubuntu1","6.1-1ubuntu1.18.04"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-0ubuntu2.1"}]}],"versions":["6.1+20190803-1ubuntu1","6.1+20191019-1ubuntu1","6.2-0ubuntu2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-2ubuntu0.1"}]}],"versions":["6.2+20201114-2build1","6.2+20201114-2build2","6.3-1","6.3-2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-lp150.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-lp151.6.3.1"}]}],"bundled":2}],"products":[{"vendor":"invisible-island","product":"ncurses"},{"vendor":"opensuse","product":"leap"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00045.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://lists.gnu.org/archive/html/bug-ncurses/2019-10/msg00013.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00059.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00061.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202101-28","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17595","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mhrh-92mr-7rw4"},{"url":"https://errata.almalinux.org/8/ALSA-2021-4426.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-17594","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-17595","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17595","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25814","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-11/msg00126.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4426","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766745","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4426.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17594","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-17595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17595","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4426","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192997-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1103320","tags":["report"]},{"url":"https://bugzilla.suse.com/1154036","tags":["report"]},{"url":"https://bugzilla.suse.com/1154037","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-17595","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193094-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131830","tags":["report"]},{"url":"https://bugzilla.suse.com/1134550","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10754","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17595","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5477-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6099-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-16879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-39537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29491","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6FHEFDTN3LEEFN2RM3PLOTVQQE3AJWPT/#6FHEFDTN3LEEFN2RM3PLOTVQQE3AJWPT","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I46ISQG6CXQ6D4AYKNE7AG32Q5DHT3VW/#I46ISQG6CXQ6D4AYKNE7AG32Q5DHT3VW","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T20:42:57Z","modified":"2026-10-14T06:54:49.378Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-7923","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T20:42:57Z","modified":"2026-10-14T06:54:49Z","updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-mhrh-92mr-7rw4","title":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the...","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2022-05-24T16:58:47Z","modified":"2026-10-14T09:31:23Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T21:15:11.427Z","modified":"2026-10-14T07:16:49.727Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T21:15:11.427Z","modified":"2026-07-08T20:15:52.67067Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T21:15:11.427Z","modified":"2026-10-15T07:47:33.215259243Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"JLSEC-2026-444","description":"There is a heap-based buffer over-read in the `fmt_entry` function in `tinfo/comp_hash.c` in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2026-05-05T15:51:30.603Z","modified":"2026-07-25T18:24:26.076128633Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:P","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"RHSA-2021:4426","title":"Red Hat Security Advisory: ncurses security update","status":"published","published":"2024-09-16T05:59:36Z","modified":"2026-07-28T10:01:17Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4426","title":"Moderate: ncurses security update","description":"The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.\n\nSecurity Fix(es):\n\n* ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)\n\n* ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:21:17Z","modified":"2026-02-04T09:45:07.283346Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-17595","description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.","status":"published","published":"2019-10-14T21:15:00Z","modified":"2026-04-22T12:14:08.90935Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2021:4426","title":"Moderate: ncurses security update","description":"The ncurses (new curses) library routines are a terminal-independent method of updating character screens with reasonable optimization. The ncurses packages contain support utilities including a terminfo compiler tic, a decompiler infocmp, clear, tput, tset, and a termcap conversion tool captoinfo.\n\nSecurity Fix(es):\n\n* ncurses: heap-based buffer overflow in the _nc_find_entry function in tinfo/comp_hash.c (CVE-2019-17594)\n\n* ncurses: heap-based buffer overflow in the fmt_entry function in tinfo/comp_hash.c (CVE-2019-17595)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T09:21:17Z","modified":"2026-10-29T11:01:44.009837136Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2019-0387","title":"Updated ncurses packages fix security vulnerabilities","description":"Updated ncurses packages fix security vulnerabilities:\n\nHeap-based buffer over-read in the _nc_find_entry function\n(CVE-2019-17594).\n\nHeap-based buffer over-read in the fmt_entry function\n(CVE-2019-17595).\n","status":"published","published":"2019-12-14T00:37:02Z","modified":"2026-04-16T04:42:26.913015551Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2550-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).\n- CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).\n\nNon-security issue fixed:\n\n- Removed screen.xterm from terminfo database (bsc#1103320).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-23T19:20:50Z","modified":"2026-02-04T04:32:50.211795Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2551-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).\n- CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).\n\nNon-security issue fixed:\n\n- Removed screen.xterm from terminfo database (bsc#1103320).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-23T19:20:59Z","modified":"2026-02-04T02:45:43.354023Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2019:2997-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-17594: Fixed a heap-based buffer over-read in the _nc_find_entry function (bsc#1154036).\n- CVE-2019-17595: Fixed a heap-based buffer over-read in the fmt_entry function (bsc#1154037).\n\nNon-security issue fixed:\n\n- Removed screen.xterm from terminfo database (bsc#1103320).\n","status":"published","published":"2019-11-18T14:16:50Z","modified":"2026-02-04T04:37:20.411919Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:3094-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2018-10754: Fixed a denial of service caused by a NULL Pointer Dereference in the _nc_parse_entry() (bsc#1131830).\n- CVE-2019-17594: Fixed a heap-based buffer over-read in _nc_find_entry function in tinfo/comp_hash.c (bsc#1154036).\n- CVE-2019-17595: Fixed a heap-based buffer over-read in fmt_entry function in tinfo/comp_hash.c (bsc#1154037).\n\nBug fixes:\n\n- Fixed ppc64le build configuration (bsc#1134550).\n","status":"published","published":"2019-11-28T15:48:05Z","modified":"2025-05-02T04:07:22.973512Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-5477-1","title":"ncurses vulnerabilities","description":"Hosein Askari discovered that ncurses was incorrectly performing\nmemory management operations when dealing with long filenames while\nwriting structures into the file system. An attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary\ncode. (CVE-2017-16879)\n\nChung-Yi Lin discovered that ncurses was incorrectly handling access\nto invalid memory areas when parsing terminfo or termcap entries where\nthe use-name had invalid syntax. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2018-19211)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. (CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files.\nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information.\n(CVE-2022-29458)\n","status":"published","published":"2022-06-14T11:17:52Z","modified":"2026-06-29T13:49:39.254663481Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-6099-1","title":"ncurses vulnerabilities","description":"It was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files.\nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. This issue only affected\nUbuntu 18.04 LTS. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-29458)\n\nIt was discovered that ncurses was parsing environment variables when\nrunning with setuid applications and not properly handling the\nprocessing of malformed data when doing so. A local attacker could\npossibly use this issue to cause a denial of service (application\ncrash) or execute arbitrary code. (CVE-2023-29491)\n","status":"published","published":"2023-05-23T11:56:42Z","modified":"2026-06-29T13:50:52.110010552Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}