{"id":"CVE-2021-39537","aliases":["ALPINE-CVE-2021-39537","AZL-6740","BELL-CVE-2021-39537","CLSA-2024-1710789286","CLSA-2026-1792806631","DEBIAN-CVE-2021-39537","DLA-3682-1","EUVD-2021-25894","GHSA-v5gv-3mwr-6223","JLSEC-2026-451","OESA-2021-1386","SUSE-SU-2021:3490-1","SUSE-SU-2021:3491-1","UBUNTU-CVE-2021-39537","USN-5477-1","USN-6099-1","openSUSE-SU-2021:1417-1","openSUSE-SU-2021:3490-1"],"status":"published","title":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based...","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.03243,"percentile":0.88482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2021-09-20T00:00:00Z","modified":"2026-10-26T09:31:55Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"ncurses","fixed_in":["6.2_p20200523-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ncurses","fixed_in":["6.2_p20200530-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"ncurses","fixed_in":["6.2-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ncurses","fixed_in":["6.2+20200912-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ncurses","fixed_in":["6.2+20200912-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ncurses","fixed_in":["6.2+20200912-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Ncurses_jll","fixed_in":["6.4.0+0"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ncurses","fixed_in":["6.2-2.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"ncurses","fixed_in":["6.2-2.oe1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ncurses","fixed_in":["5.9-75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ncurses","fixed_in":["5.9-75.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ncurses","fixed_in":["5.9-75.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","fixed_in":["5.9+20140118-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","fixed_in":["6.0+20160213-1ubuntu1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","fixed_in":["6.1-1ubuntu1.18.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","fixed_in":["6.2-0ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ncurses","fixed_in":["6.1-lp152.8.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"ncurses","fixed_in":["6.1-5.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200523-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2_p20200530-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-6"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"ncurses-term","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-14.20130511.el7_4.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"ncurses-term","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-4.20090207.el6.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+20200912-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+20200912-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2+20200912-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1+20181013-2+deb10u5"}]}],"versions":["6.1+20181013-2","6.1+20181013-2+deb10u1","6.1+20181013-2+deb10u2","6.1+20181013-2+deb10u3","6.1+20181013-2+deb10u4"],"bundled":2},{"source":"osv","ecosystem":"Julia","package":"Ncurses_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.0+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-2.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-2.oe1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.0","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-75.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-75.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1ubuntu1.18.04.1"}]}],"versions":["6.0+20160625-1ubuntu1","6.0+20171125-1ubuntu1","6.1-1ubuntu1","6.1-1ubuntu1.18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-0ubuntu2.1"}]}],"versions":["6.1+20190803-1ubuntu1","6.1+20191019-1ubuntu1","6.2-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm2"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm2"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9+20140118-1ubuntu1+esm3"}]}],"versions":["5.9+20130608-1ubuntu1","5.9+20131221-1ubuntu1","5.9+20140118-1ubuntu1","5.9+20140118-1ubuntu1+esm1","5.9+20140118-1ubuntu1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+20160213-1ubuntu1+esm3"}]}],"versions":["5.9+20150516-2ubuntu1","6.0+20151024-2ubuntu1","6.0+20151024-2ubuntu2","6.0+20160213-1ubuntu1","6.0+20160213-1ubuntu1+esm1","6.0+20160213-1ubuntu1+esm2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-1ubuntu1.18.04.1"}]}],"versions":["6.0+20160625-1ubuntu1","6.0+20171125-1ubuntu1","6.1-1ubuntu1","6.1-1ubuntu1.18.04"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-0ubuntu2.1"}]}],"versions":["6.1+20190803-1ubuntu1","6.1+20191019-1ubuntu1","6.2-0ubuntu2"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-2ubuntu0.1"}]}],"versions":["6.2+20201114-2build1","6.2+20201114-2build2","6.3-1","6.3-2"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-lp152.8.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-5.9.1"}]}]}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"macos"},{"vendor":"invisible-island","product":"ncurses"}],"references":[{"url":"https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html","tags":["x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","web","report"]},{"url":"https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html","tags":["x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1\u0026content-type=text/x-cvsweb-markup","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://support.apple.com/kb/HT213443","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213444","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://support.apple.com/kb/HT213488","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/41","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/28","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/43","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2022/Oct/45","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0012/","tags":["x_transferred","advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39537","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0012"},{"url":"https://github.com/advisories/GHSA-v5gv-3mwr-6223"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-39537","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-39537","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1710789286.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1792806631.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-29491","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-39537","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1386","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213490-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190793","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39537","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213491-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-39537","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5477-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6099-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-39537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-16879","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17594","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-17595","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29491","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RTS45TDORJPZD3OEON7W6CTYLNX6KQ3J/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2IZOG455BIMQ6NKBIPOWITV4SHIG5YT7/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T00:00:00Z","modified":"2026-10-08T21:03:26.809Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-25894","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T00:00:00Z","modified":"2026-10-08T21:03:26Z","updated_at":"2026-11-02T17:27:26.856493Z"}],"ghsa":[{"id":"GHSA-v5gv-3mwr-6223","title":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based...","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2022-05-24T19:15:09Z","modified":"2026-07-27T15:32:39Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:09:49.995101Z"}],"nvd":[{"id":"CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:12.477Z","modified":"2026-10-08T21:17:39.667Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:06:58.933037Z"}],"osv":[{"id":"ALPINE-CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:12.477Z","modified":"2026-10-23T17:17:56.207657629Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-6740","title":"CVE-2021-39537 affecting package ncurses for versions less than 6.2-6","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:12Z","modified":"2026-04-21T04:38:09.392756Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2021-39537","title":"CVE-2021-39537 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:12.441783Z","modified":"2026-01-26T09:49:13.220316Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:12.477Z","modified":"2026-03-15T22:41:39.828328Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:20.843843Z"},{"id":"DEBIAN-CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:12.477Z","modified":"2026-10-09T09:47:34.16388164Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"JLSEC-2026-451","description":"An issue was discovered in ncurses through v6.2-1. `_nc_captoinfo` in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2026-05-05T15:51:30.603Z","modified":"2026-07-25T18:24:27.14651415Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2021-1386","title":"ncurses security update","description":"The ncurses (new curses) library is a free software emulation of curses in System V Release 4.0 (SVr4), and more. It uses terminfo format, supports pads and color and multiple highlights and forms characters and function-key mapping, and has all the other SVr4-curses enhancements over BSD curses. SVr4 curses became the basis of X/Open Curses.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.(CVE-2021-39537)","status":"published","published":"2021-10-15T11:04:39Z","modified":"2026-08-18T01:16:04.882901475Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2021-39537","description":"An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.","status":"published","published":"2021-09-20T16:15:00Z","modified":"2026-04-22T12:59:15.371076Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"CLSA-2024-1710789286","title":"ncurses: Fix of 2 CVEs","description":"- CVE-2023-29491.patch: Mitigate vulnerability by building the packages with\n  modified --disable-root-environ option which now limits usage of environment\n  for setuid/setgid programs only\n- CVE-2021-39537.patch: Add a check for end-of-string in cvtchar to handle a\n  malformed string in infotocap","status":"published","published":"2024-03-18T19:14:50Z","modified":"2026-10-21T10:47:50.682823382Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"CLSA-2026-1792806631","title":"ncurses: Fix of 2 CVEs","description":"- CVE-2021-39537: fix heap buffer overflow in _nc_captoinfo() with a crafted termcap entry\n- CVE-2023-29491: ignore terminfo/termcap environment variables in setuid/setgid\n  programs (--disable-root-environ)","status":"published","published":"2026-10-24T01:50:43Z","modified":"2026-10-26T09:31:55.310919711Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"DLA-3682-1","title":"ncurses - security update","status":"published","published":"2023-12-03T00:00:00Z","modified":"2026-03-09T01:18:42.667623Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2021:1417-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-10-31T15:07:50Z","modified":"2026-02-04T03:17:18.973826Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3490-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)\n","status":"published","published":"2021-10-20T14:32:21Z","modified":"2026-02-04T03:19:14.943823Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-SU-2021:3490-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)\n","status":"published","published":"2021-10-20T14:32:25Z","modified":"2026-02-04T03:43:52.366295Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3491-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2021-39537: Fixed an heap-based buffer overflow in _nc_captoinfo. (bsc#1190793)\n","status":"published","published":"2021-10-20T14:37:26Z","modified":"2026-02-04T04:32:39.340002Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5477-1","title":"ncurses vulnerabilities","description":"Hosein Askari discovered that ncurses was incorrectly performing\nmemory management operations when dealing with long filenames while\nwriting structures into the file system. An attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary\ncode. (CVE-2017-16879)\n\nChung-Yi Lin discovered that ncurses was incorrectly handling access\nto invalid memory areas when parsing terminfo or termcap entries where\nthe use-name had invalid syntax. An attacker could possibly use this\nissue to cause a denial of service. (CVE-2018-19211)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. (CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files.\nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information.\n(CVE-2022-29458)\n","status":"published","published":"2022-06-14T11:17:52Z","modified":"2026-06-29T13:49:39.254663481Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-6099-1","title":"ncurses vulnerabilities","description":"It was discovered that ncurses was incorrectly performing bounds\nchecks when processing invalid hashcodes. An attacker could possibly\nuse this issue to cause a denial of service or to expose sensitive\ninformation. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2019-17594)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when processing terminfo and termcap files.\nAn attacker could possibly use this issue to cause a denial of\nservice or to expose sensitive information. This issue only affected\nUbuntu 18.04 LTS. (CVE-2019-17595)\n\nIt was discovered that ncurses was incorrectly handling\nend-of-string characters when converting between termcap and\nterminfo formats. An attacker could possibly use this issue to cause\na denial of service or execute arbitrary code. This issue only\naffected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-39537)\n\nIt was discovered that ncurses was incorrectly performing bounds\nchecks when dealing with corrupt terminfo data while reading a\nterminfo file. An attacker could possibly use this issue to cause a\ndenial of service or to expose sensitive information. This issue only\naffected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.\n(CVE-2022-29458)\n\nIt was discovered that ncurses was parsing environment variables when\nrunning with setuid applications and not properly handling the\nprocessing of malformed data when doing so. A local attacker could\npossibly use this issue to cause a denial of service (application\ncrash) or execute arbitrary code. (CVE-2023-29491)\n","status":"published","published":"2023-05-23T11:56:42Z","modified":"2026-06-29T13:50:52.110010552Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}