CVE-2017-10684
Fixed in a distro release EPSS 5%
In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input will lead to a remote arbitrary code execution attack.
Products: invisible-island ncurses
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.11 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.12 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.13 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.14 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.15 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.16 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.17 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.18 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.19 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.20 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.21 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.22 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.23 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.24 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.3 | ncurses | 6.0-r7 |
| Alpine 3.4 | ncurses | 6.0-r8 |
| Alpine 3.5 | ncurses | 6.0-r8 |
| Alpine 3.6 | ncurses | 6.0-r8 |
| Alpine 3.7 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.8 | ncurses | 6.0_p20170701-r0 |
| Alpine 3.9 | ncurses | 6.0_p20170701-r0 |
| Amazon Linux 2 | ncurses | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-base | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-c++-libs | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-compat-libs | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-devel | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-libs | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-static | 6.0-8.20170212.amzn2.1.3 |
| Amazon Linux 2 | ncurses-term | 6.0-8.20170212.amzn2.1.3 |
| Debian 12 | ncurses | 6.0+20170708-1 |
| Debian 13 | ncurses | 6.0+20170708-1 |
| Debian 14 | ncurses | 6.0+20170708-1 |
| SUSE Linux Enterprise Desktop 12 SP2 | ncurses | 5.9-44.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Server 11 SP4 | ncurses | 5.6-92.1 |
| SUSE Linux Enterprise Server 11 SP4 | ncurses | 5.6-93.6.1 |
| SUSE Linux Enterprise Server 12 SP2 | ncurses | 5.9-44.1 |
| SUSE Linux Enterprise Server 12 SP2 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Server 12 SP3 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | ncurses | 5.9-44.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ncurses | 5.6-93.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | ncurses | 5.6-92.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ncurses | 5.9-44.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | ncurses | 5.6-93.6.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | ncurses | 5.6-92.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | ncurses | 5.9-50.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | ncurses | 5.9-44.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | ncurses | 5.9-50.1 |
| Ubuntu Pro 14.04 LTS | ncurses | 5.9+20140118-1ubuntu1+esm1 |
| Ubuntu Pro 16.04 LTS | ncurses | 6.0+20160213-1ubuntu1+esm1 |