Description
In ncurses, possibly a 6.x version, there is a NULL pointer dereference at the function _nc_name_match that will lead to a denial of service attack. NOTE: the original report stated version 6.1, but the issue did not reproduce for that version according to the maintainer or a reliable third-party
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ncurses | 6.0+20170701-1 | — |
| Debian 13 | ncurses | 6.0+20170701-1 | — |
| Debian 12 | ncurses | 6.0+20170701-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | ncurses | 6.0+20160213-1ubuntu1+esm1 | — |
| Ubuntu Pro 14.04 LTS | ncurses | 5.9+20140118-1ubuntu1+esm1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ncurses | No fix yet | — |