Skip to content
OpenAdvisories
Unscored CVE-2017-13729 EUVD-2017-5246GHSA-rw7r-p3xc-j3x9

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service…

Published Aug 29, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: ncurses Package: ncurses Package: ncurses Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

There is an illegal address access in the _nc_save_str function in alloc_entry.c in ncurses 6.0. It will lead to a remote denial of service attack.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 ncurses 6.0+20170827-1 —
Debian 13 ncurses 6.0+20170827-1 —
Debian 12 ncurses 6.0+20170827-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS ncurses 6.0+20160213-1ubuntu1+esm1 USN-5448-1
Ubuntu Pro 14.04 LTS ncurses 5.9+20140118-1ubuntu1+esm1 USN-5448-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP3 ncurses 5.9-55.1 SUSE-SU-2018:0284-1, SUSE-SU-2018:0120-1
SLES 12 SP2 ncurses 5.9-55.1 SUSE-SU-2018:0284-1, SUSE-SU-2018:0120-1
SLES 11 SP4 ncurses 5.6-93.12.1 SUSE-SU-2017:3183-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP3 ncurses 5.9-55.1 SUSE-SU-2018:0284-1, SUSE-SU-2018:0120-1
SLES for SAP 12 SP2 ncurses 5.9-55.1 SUSE-SU-2018:0284-1, SUSE-SU-2018:0120-1
SLES for SAP 11 SP4 ncurses 5.6-93.12.1 SUSE-SU-2017:3183-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.6 ncurses 6.0_p20170930-r0 —
Alpine v3.5 ncurses 6.0_p20170701-r0 —
Alpine v3.4 ncurses 6.0_p20170701-r0 —
Alpine v3.3 ncurses 6.0_p20170701-r0 —

Advisories 4

References