Skip to content
OpenAdvisories
High ALAS2023-2023-220 1 CVE

Important: ncurses security update (Amazon Linux 2023)

Published Jun 21, 2023 · Updated Jun 27, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-29491: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Fixed packages 13

ReleasePackageFixed in
Amazon Linux · 2023 ncurses 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-base 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-c++-libs 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-c++-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-compat-libs 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-compat-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-debuginfo 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-debugsource 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-devel 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-libs 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-libs-debuginfo 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-static 0:6.2-4.20200222.amzn2023.0.4
Amazon Linux · 2023 ncurses-term 0:6.2-4.20200222.amzn2023.0.4

Vulnerabilities 1

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-29491.html