Skip to content
OpenAdvisories
Low ALAS2-2018-1053 1 CVE

Low: ncurses security update (Amazon Linux 2)

Published Aug 8, 2018 · Updated Aug 9, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-10754: A NULL pointer dereference was found in the way the _nc_parse_entry function parses terminfo data for compilation. An attacker able to provide specially crafted terminfo data could use this flaw to crash the application parsing it. 1576119: CVE-2018-10754 ncurses: NULL Pointer Dereference in _nc_parse_entry function in tinfo/parse_entry.c.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 ncurses 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-base 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-c++-libs 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-compat-libs 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-debuginfo 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-devel 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-libs 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-static 0:6.0-8.20170212.amzn2.1.1
Amazon Linux · 2 ncurses-term 0:6.0-8.20170212.amzn2.1.1

Vulnerabilities 1

  • Unscored —
    CVE-2018-10754 Rejected

    DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…

    ncurses Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-10754.html