In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ncurses | Jul 30, 2024 | Nov 12, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade ncursesUpgrade ncurses-baseUpgrade ncurses-libsUpgrade ncurses-develUpgrade ncurses-term | Dec 4, 2019 | Nov 12, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade ncursesUpgrade ncurses-termUpgrade ncurses-libsUpgrade ncurses-baseUpgrade ncurses-devel | Dec 18, 2019 | Nov 12, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Nov 12, 2018 |
| Suse | — | Upgrade terminfo-screenUpgrade ncurses5-devel-32bitUpgrade ncurses5-develUpgrade terminfo-itermUpgrade libncurses5-32bitUpgrade libncurses5Upgrade terminfoUpgrade libncurses6Upgrade libncurses6-32bitUpgrade tackUpgrade ncurses-develUpgrade ncurses-devel-32bitUpgrade ncurses-utilsUpgrade terminfo-base | Dec 4, 2018 | Nov 12, 2018 |
| Ubuntu | — | Upgrade libncurses5 (Ubuntu Pro)Upgrade libtinfo5 (Ubuntu Pro)Upgrade ncurses-bin (Ubuntu Pro) | Mar 22, 2023 | Nov 12, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub