CVE-2017-13730

ncurses: Illegal address access in the function _nc_read_entry_source()

There is an illegal address access in the function _nc_read_entry_source() in progs/tic.c in ncurses 6.0 that might lead to a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-13729

ncurses: Illegal address access in the _nc_save_str function

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

CVSS 3.0 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-13728

ncurses: Infinite loop in the next_char function

There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic. A crafted input will lead to a remote denial of service attack.

CVSS 3.0 · 7.5 High EPSS 4.2% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-11113

ncurses: Null pointer dereference vulnerability in _nc_parse_entry function

In ncurses 6.0, there is a NULL Pointer Dereference in the _nc_parse_entry function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

CVSS 3.0 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-10684

ncurses: Stack-based buffer overflow in fmt_entry function in dump_entry.c

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

CVSS 3.0 · 9.8 Critical EPSS 4.9% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-11112

ncurses: Illegal address access in append_acs function

In ncurses 6.0, there is an attempted 0xffffffffffffffff access in the append_acs function of tinfo/parse_entry.c. It could lead to a remote denial of service attack if the terminfo library code is used to process untrusted terminfo data.

CVSS 3.0 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2017-10685

ncurses: Stack-based buffer overflow caused by format string vulnerability in fmt_entry function

In ncurses 6.0, there is a format string vulnerability in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.

CVSS 3.1 · 0.0 Low EPSS 4.3% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2018-19217

ncurses: Null pointer dereference at function _nc_name_match

In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party

CVSS 3.0 · 6.5 Medium EPSS 1.2% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses

CVE-2018-19211

ncurses: Null pointer dereference at function _nc_parse_entry in parse_entry.c

In ncurses 6.1, there is a NULL pointer dereference at function _nc_parse_entry in parse_entry.c that will lead to a denial of service attack. The product proceeds to the dereference code path even after a "dubious character `*' in name or alias field" detection.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Invisible-island

Products

Ncurses