Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29458: A segmentation fault vulnerability was found in ncurses's convert_strings() function of tinfo/read_entry.c file. This flaw occurs due to corrupted terminfo data, triggering an out-of-bounds read error. CVE-2021-39537: The ncurses package (tic) is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | ncurses | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-base | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-c++-libs | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-compat-libs | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-debuginfo | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-devel | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-libs | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-static | 0:6.0-8.20170212.amzn2.1.4 |
| Amazon Linux · 2 | ncurses-term | 0:6.0-8.20170212.amzn2.1.4 |
Vulnerabilities 2
-
High 7.1
ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read…
-
Unscored —
An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.