6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
82.2%
Package : ncurses
Version : 6.1+20181013-2+deb10u5
CVE ID : CVE-2021-39537 CVE-2023-29491
Debian Bug : 1034372
Issues were found in ncurses, a collection of shared libraries for
terminal handling, which could lead to denial of service.
CVE-2021-39537
It has been discovered that the tic(1) utility is susceptible to a
heap overflow on crafted input due to improper bounds checking.
CVE-2023-29491
Jonathan Bar Or, Michael Pearse and Emanuele Cozzi have discovered
that when ncurses is used by a setuid application, a local user can
trigger security-relevant memory corruption via malformed data in a
terminfo database file found in $HOME/.terminfo or reached via the
TERMINFO or TERM environment variables.
In order to mitigate this issue, ncurses now further restricts
programs running with elevated privileges (setuid/setgid programs).
Programs run by the superuser remain able to load custom terminfo
entries.
This change aligns ncurses' behavior in buster-security with that of
Debian Bullseye's latest point release (6.2+20201114-2+deb11u2).
For Debian 10 buster, these problems have been fixed in version
6.1+20181013-2+deb10u5.
We recommend that you upgrade your ncurses packages.
For the detailed security status of ncurses please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ncurses
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 11 | s390x | libncursesw6 | < 6.2+20201114-2+deb11u2 | libncursesw6_6.2+20201114-2+deb11u2_s390x.deb |
Debian | 10 | i386 | libtinfo6 | < 6.1+20181013-2+deb10u5 | libtinfo6_6.1+20181013-2+deb10u5_i386.deb |
Debian | 11 | arm64 | libtinfo-dev | < 6.2+20201114-2+deb11u2 | libtinfo-dev_6.2+20201114-2+deb11u2_arm64.deb |
Debian | 11 | i386 | libtinfo6 | < 6.2+20201114-2+deb11u2 | libtinfo6_6.2+20201114-2+deb11u2_i386.deb |
Debian | 11 | amd64 | ncurses-examples | < 6.2+20201114-2+deb11u2 | ncurses-examples_6.2+20201114-2+deb11u2_amd64.deb |
Debian | 11 | i386 | libncursesw5-dbgsym | < 6.2+20201114-2+deb11u2 | libncursesw5-dbgsym_6.2+20201114-2+deb11u2_i386.deb |
Debian | 11 | arm64 | libtinfo6 | < 6.2+20201114-2+deb11u2 | libtinfo6_6.2+20201114-2+deb11u2_arm64.deb |
Debian | 10 | i386 | libtinfo6-udeb | < 6.1+20181013-2+deb10u5 | libtinfo6-udeb_6.1+20181013-2+deb10u5_i386.deb |
Debian | 10 | arm64 | libtinfo6-udeb | < 6.1+20181013-2+deb10u5 | libtinfo6-udeb_6.1+20181013-2+deb10u5_arm64.deb |
Debian | 11 | armhf | libtinfo5-dbgsym | < 6.2+20201114-2+deb11u2 | libtinfo5-dbgsym_6.2+20201114-2+deb11u2_armhf.deb |
6.8 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.8 High
AI Score
Confidence
High
0.008 Low
EPSS
Percentile
82.2%