Stack-based buffer overflow in the _nc_write_entry function in tinfo/write_entry.c in ncurses 6.0 allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade ncurses | Jan 26, 2018 | Nov 22, 2017 |
| Debian | — | Upgrade ncurses | Jul 30, 2024 | Nov 22, 2017 |
| Gentoo Linux | — | Upgrade sys-libs/ncurses. | Apr 18, 2018 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade ncurses-baseUpgrade ncurses-develUpgrade ncurses-termUpgrade ncurses-libsUpgrade ncurses | Jan 19, 2018 | Nov 22, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ncurses-libsUpgrade ncursesUpgrade ncurses-baseUpgrade ncurses-develUpgrade ncurses-term | Jan 19, 2018 | Nov 22, 2017 |
| Oracle Solaris | — | Upgrade library/ncurses to version 6.1.0.20190105-11.4.8.0.1.1.0 on Solaris 11.4 | Apr 17, 2019 | Nov 22, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 18, 2017 |
| Suse | — | Upgrade ncurses-utilsUpgrade ncurses-develUpgrade libncurses6-x86Upgrade libncurses5-32bitUpgrade tackUpgrade libncurses5Upgrade libncurses6-32bitUpgrade terminfoUpgrade libncurses6Upgrade terminfo-baseUpgrade ncurses-devel-32bitUpgrade libncurses5-x86 | Dec 1, 2017 | Nov 22, 2017 |
| Ubuntu | — | Upgrade libtinfo5 (Ubuntu Pro)Upgrade libncurses5 (Ubuntu Pro)Upgrade ncurses-bin (Ubuntu Pro) | Mar 22, 2023 | Nov 22, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 22, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub