Ubuntu 5477-1: ncurses vulnerabilities | LinuxSecurity.com
==========================================================================
Ubuntu Security Notice USN-5477-1
June 14, 2022

ncurses vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in ncurses.

Software Description:
- ncurses: shared libraries for terminal handling (32-bit)

Details:

Hosein Askari discovered that ncurses was incorrectly performing
memory management operations when dealing with long filenames while
writing structures into the file system. An attacker could possibly
use this issue to cause a denial of service or execute arbitrary
code. (CVE-2017-16879)

Chung-Yi Lin discovered that ncurses was incorrectly handling access
to invalid memory areas when parsing terminfo or termcap entries where
the use-name had invalid syntax. An attacker could possibly use this
issue to cause a denial of service. (CVE-2018-19211)

It was discovered that ncurses was incorrectly performing bounds
checks when processing invalid hashcodes. An attacker could possibly
use this issue to cause a denial of service or to expose sensitive
information. (CVE-2019-17594)

It was discovered that ncurses was incorrectly handling
end-of-string characters when processing terminfo and termcap files.
An attacker could possibly use this issue to cause a denial of
service or to expose sensitive information. (CVE-2019-17595)

It was discovered that ncurses was incorrectly handling
end-of-string characters when converting between termcap and
terminfo formats. An attacker could possibly use this issue to cause
a denial of service or execute arbitrary code. (CVE-2021-39537)

It was discovered that ncurses was incorrectly performing bounds
checks when dealing with corrupt terminfo data while reading a
terminfo file. An attacker could possibly use this issue to cause a
denial of service or to expose sensitive information.
(CVE-2022-29458)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
   libncurses5                     6.0+20160213-1ubuntu1+esm2
   libtinfo5                       6.0+20160213-1ubuntu1+esm2
   ncurses-bin                     6.0+20160213-1ubuntu1+esm2

Ubuntu 14.04 ESM:
   libncurses5                     5.9+20140118-1ubuntu1+esm2
   libtinfo5                       5.9+20140118-1ubuntu1+esm2
   ncurses-bin                     5.9+20140118-1ubuntu1+esm2

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5477-1
   CVE-2017-16879, CVE-2018-19211, CVE-2019-17594, CVE-2019-17595,
   CVE-2021-39537, CVE-2022-29458

Ubuntu 5477-1: ncurses vulnerabilities

June 14, 2022
Several security issues were fixed in ncurses.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in ncurses. Software Description: - ncurses: shared libraries for terminal handling (32-bit) Details: Hosein Askari discovered that ncurses was incorrectly performing memory management operations when dealing with long filenames while writing structures into the file system. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2017-16879) Chung-Yi Lin discovered that ncurses was incorrectly handling access to invalid memory areas when parsing terminfo or termcap entries where the use-name had invalid syntax. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-19211) It was discovered that ncurses was incorrectly performing bounds checks when processing invalid hashcodes. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17594) It was discovered that ncurses was incorrectly handling end-of-string characters when processing terminfo and termcap files. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2019-17595) It was discovered that ncurses was incorrectly handling end-of-string characters when converting between termcap and terminfo formats. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-39537) It was discovered that ncurses was incorrectly performing bounds checks when dealing with corrupt terminfo data while reading a terminfo file. An attacker could possibly use this issue to cause a denial of service or to expose sensitive information. (CVE-2022-29458)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 16.04 ESM:   libncurses5                     6.0+20160213-1ubuntu1+esm2   libtinfo5                       6.0+20160213-1ubuntu1+esm2   ncurses-bin                     6.0+20160213-1ubuntu1+esm2 Ubuntu 14.04 ESM:   libncurses5                     5.9+20140118-1ubuntu1+esm2   libtinfo5                       5.9+20140118-1ubuntu1+esm2   ncurses-bin                     5.9+20140118-1ubuntu1+esm2 In general, a standard system update will make all the necessary changes.

References

  https://ubuntu.com/security/notices/USN-5477-1

  CVE-2017-16879, CVE-2018-19211, CVE-2019-17594, CVE-2019-17595,

  CVE-2021-39537, CVE-2022-29458

Severity
Ubuntu Security Notice USN-5477-1

Package Information

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.