Skip to content
OpenAdvisories
Medium ALAS2023-2023-023 2 CVEs

Moderate: ncurses security update (Amazon Linux 2023)

Published Feb 17, 2023 · Updated Feb 22, 2023

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2022-29458: A segmentation fault vulnerability was found in ncurses's convert_strings() function of tinfo/read_entry.c file. This flaw occurs due to corrupted terminfo data, triggering an out-of-bounds read error. CVE-2021-39537: The ncurses package (tic) is susceptible to a heap overflow on crafted input. When the terminfo entry-description compiler processes input, proper bounds checking was not enforced leading to this software flaw. The highest threat from this vulnerability is system availability.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2023 ncurses 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-base 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-c++-libs 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-c++-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-compat-libs 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-compat-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-debuginfo 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-debugsource 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-devel 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-libs 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-static 0:6.2-4.20200222.amzn2023.0.3
Amazon Linux · 2023 ncurses-term 0:6.2-4.20200222.amzn2023.0.3

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2021-39537.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-29458.html