Summary
[6.2-10.20210508]
- ignore TERMINFO and HOME only if setuid/setgid/capability (#2211666)
[6.2-9.20210508]
- fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
- ignore TERMINFO and HOME environment variables if running as root (#2211666)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | ncurses | 0:6.2-10.20210508.el9 |
| Oracle Linux · 9 | ncurses-base | 0:6.2-10.20210508.el9 |
| Oracle Linux · 9 | ncurses-c++-libs | 0:6.2-10.20210508.el9 |
| Oracle Linux · 9 | ncurses-devel | 0:6.2-10.20210508.el9 |
| Oracle Linux · 9 | ncurses-libs | 0:6.2-10.20210508.el9 |
| Oracle Linux · 9 | ncurses-term | 0:6.2-10.20210508.el9 |
Vulnerabilities 1
-
Unscored —
ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory …