Skip to content
OpenAdvisories
Medium ALAS2-2022-1893 2 CVEs

Moderate: ncurses security update (Amazon Linux 2)

Published Dec 1, 2022 · Updated Dec 6, 2022

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-29458: A segmentation fault vulnerability was found in ncurses's convert_strings() function of tinfo/read_entry.c file. This flaw occurs due to corrupted terminfo data, triggering an out-of-bounds read error. CVE-2021-39537: The ncurses package (tic) is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 ncurses 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-base 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-c++-libs 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-compat-libs 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-debuginfo 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-devel 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-libs 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-static 0:6.0-8.20170212.amzn2.1.4
Amazon Linux · 2 ncurses-term 0:6.0-8.20170212.amzn2.1.4

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39537.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29458.html