{"id":"CVE-2023-45918","aliases":["BELL-CVE-2023-45918","EUVD-2023-50181","GHSA-pfv6-3f5p-j5c6","OESA-2024-1125","SUSE-SU-2024:1132-1","SUSE-SU-2024:1133-1","SUSE-SU-2024:1133-2","UBUNTU-CVE-2023-45918"],"status":"rejected","title":"ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-02-02T11:06:34Z","modified":"2026-08-18T01:18:14Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP1","package":"ncurses","fixed_in":["6.2-6.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"ncurses","fixed_in":["6.2-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"ncurses","fixed_in":["6.3-14.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"ncurses","fixed_in":["6.3-10.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"ncurses","fixed_in":["6.3-14.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"ncurses","fixed_in":["6.3-14.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ncurses","fixed_in":["5.9-88.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ncurses","fixed_in":["5.9-88.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ncurses","fixed_in":["5.9-88.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"ncurses","fixed_in":["6.1-150000.5.24.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-6.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-14.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-10.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-14.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3-14.oe2203sp3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-88.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-88.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9-88.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"ncurses","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1-150000.5.24.1"}]}]}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45918","tags":["advisory"]},{"url":"https://lists.gnu.org/archive/html/bug-ncurses/2023-06/msg00005.html","tags":["web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240315-0006"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2300290#c1","tags":["report"]},{"url":"https://github.com/advisories/GHSA-pfv6-3f5p-j5c6"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-45918","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240315-0006/","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-45918","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1125","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220061","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45918","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241133-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241133-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45918","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45918","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-45918","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-02-16T00:00:00Z","modified":"2024-11-21T20:25:34.899Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-50181","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"published","published":"2024-02-16T00:00:00Z","modified":"2024-11-21T20:25:34Z","updated_at":"2026-11-03T00:04:51.282957Z"}],"ghsa":[{"id":"GHSA-pfv6-3f5p-j5c6","title":"ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.","description":"ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.","status":"published","published":"2024-02-17T00:31:38Z","modified":"2024-10-31T21:31:44Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:58:40.851254Z"}],"nvd":[{"id":"CVE-2023-45918","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2024-02-16T22:15:07.88Z","modified":"2024-11-21T21:15:10.63Z","updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"BELL-CVE-2023-45918","title":"CVE-2023-45918 does not affect BellSoft software","status":"withdrawn","published":"2024-02-20T05:57:17.569505Z","modified":"2026-01-26T09:48:58.510217Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"OESA-2024-1125","title":"ncurses security update","description":"The ncurses (new curses) library is a free software emulation of  curses in System V Release 4.0 (SVr4), and more. It uses terminfo  format, supports pads and color and multiple highlights and forms  characters and function-key mapping, and has all the other SVr4-curses  enhancements over BSD curses. SVr4 curses became the basis of X/Open Curses.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in GNU ncurses 6.4-20230610. It has been rated as problematic. This issue affects the function tgetstr. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2023-45918)","status":"published","published":"2024-02-02T11:06:34Z","modified":"2026-08-18T01:18:14.266863161Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"CVE-2023-45918","description":"ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c. NOTE: Multiple third parties have disputed this indicating upstream does not regard it as a security issue.","status":"withdrawn","published":"2024-02-16T22:15:07Z","modified":"2024-10-31T20:50:10.742932Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"SUSE-SU-2024:1132-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2023-45918: Fixed NULL pointer dereference via corrupted xterm-256color file (bsc#1220061).\n","status":"published","published":"2024-04-08T09:28:31Z","modified":"2026-02-04T03:50:08.431255Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1133-1","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2023-45918: Fixed NULL pointer dereference via corrupted xterm-256color file (bsc#1220061).\n","status":"published","published":"2024-04-08T09:29:08Z","modified":"2026-02-04T04:27:41.442887Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:1133-2","title":"Security update for ncurses","description":"This update for ncurses fixes the following issues:\n\n- CVE-2023-45918: Fixed NULL pointer dereference via corrupted xterm-256color file (bsc#1220061).\n","status":"published","published":"2024-04-08T09:29:24Z","modified":"2025-05-02T04:35:35.84216Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"UBUNTU-CVE-2023-45918","description":"ncurses 6.4-20230610 has a NULL pointer dereference in tgetstr in tinfo/lib_termcap.c.","status":"withdrawn","published":"2024-02-16T22:15:00Z","modified":"2025-07-18T16:54:39Z","updated_at":"2026-11-02T16:54:22.741943Z"}]}}