Skip to content
OpenAdvisories
Medium ALAS2-2024-2412 8 CVEs

Moderate: ncurses security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Jan 9, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-19190: Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2020-19189: Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2020-19188: Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2020-19187: Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2020-19186: Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2020-19185: Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attackers to cause a denial of service via crafted command. CVE-2019-17595: There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012. CVE-2019-17594: There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.

Fixed packages 9

ReleasePackageFixed in
Amazon Linux · 2 ncurses 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-base 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-c++-libs 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-compat-libs 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-debuginfo 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-devel 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-libs 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-static 0:6.0-8.20170212.amzn2.1.6
Amazon Linux · 2 ncurses-term 0:6.0-8.20170212.amzn2.1.6

Vulnerabilities 8

  • Unscored —
    CVE-2019-17594

    There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in n…

    ncurses ncurses Debian Ubuntu
  • Unscored —
    CVE-2019-17595

    There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurse…

    ncurses ncurses Debian Ubuntu
  • Unscored —
    CVE-2020-19185

    Buffer Overflow vulnerability in one_one_mapping function in progs/dump_entry.c:1373 in ncurses 6.1 allows remote attac…

    ncurses Debian
  • Unscored —
    CVE-2020-19186

    Buffer Overflow vulnerability in _nc_find_entry function in tinfo/comp_hash.c:66 in ncurses 6.1 allows remote attackers…

    ncurses Debian
  • Unscored —
    CVE-2020-19187

    Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1100 in ncurses 6.1 allows remote attackers t…

    ncurses Debian
  • Unscored —
    CVE-2020-19188

    Buffer Overflow vulnerability in fmt_entry function in progs/dump_entry.c:1116 in ncurses 6.1 allows remote attackers t…

    ncurses Debian
  • Unscored —
    CVE-2020-19189

    Buffer Overflow vulnerability in postprocess_terminfo function in tinfo/parse_entry.c:997 in ncurses 6.1 allows remote …

    ncurses ncurses Debian Ubuntu
  • Unscored —
    CVE-2020-19190

    Buffer Overflow vulnerability in _nc_find_entry in tinfo/comp_hash.c:70 in ncurses 6.1 allows remote attackers to cause…

    ncurses Debian

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-17594.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2019-17595.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19185.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19186.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19187.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19188.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19189.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-19190.html