Summary
It was discovered that ncurses incorrectly handled certain terminfo
entries in the infocmp tool. An attacker could possibly use this issue
to cause a denial of service via a crafted terminfo file.
The default compiler options for affected releases should reduce the
vulnerability to a denial of service.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | ncurses | 5.9+20140118-1ubuntu1+esm6 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ncurses | 6.0+20160213-1ubuntu1+esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ncurses | 6.1-1ubuntu1.18.04.1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ncurses | 6.2-0ubuntu2.1+esm1 |
Vulnerabilities 1
-
High 7.3CVE-2025-69720 Public exploit
The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in pro…
References
-
report
https://ubuntu.com/security/CVE-2025-69720